Cross-site request forgery In hono
Description
Hono CSRF middleware can be bypassed using crafted Content-Type header
Summary
Hono CSRF middleware can be bypassed using crafted Content-Type header.
Details
MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.
As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".
PoC
<html> <head> <title>CSRF Test</title> <script defer> document.addEventListener("DOMContentLoaded", () => { document.getElementById("btn").addEventListener("click", async () => { const res = await fetch("http://victim.example.com/test", { method: "POST",...
Impact
Bypass csrf protection implemented with hono csrf middleware.
Discussion
I'm not sure that omitting csrf checks for Simple POST request is a good idea. CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 4.5.8 |
Aliases
References