Executive brief
Hono is a lightweight web framework used to build web applications and REST APIs. When using TrieRouter, a routing option in Hono, named path parameters (like ID or version numbers) can be incorrectly carried over from previous requests due to a state-handling defect. This could allow a privileged user to accidentally or intentionally delete, modify, or access unintended API resources by reusing parameters from prior requests.
Technical details
The vulnerability is a path parameter state contamination issue (CWE-94) in Hono's TrieRouter routing component. The root cause is improper cleanup or isolation of named path parameters between sequential requests, allowing parameter values from one request to persist into subsequent requests when timing conditions align. The attack requires no authentication but needs user interaction and precise request timing due to asynchronous request processing with random delays. An attacker can trigger this by sending multiple requests to endpoints with named parameters and exploiting race conditions; the most severe impact is unintended REST resource deletion. TrieRouter is used when applications explicitly select it or when routing patterns are incompatible with the default RegExpRouter. The issue was patched in Hono v3.11.7.
Affected products
- Hono Hono before 3.11.7
Timeline
- 2023-12-15: disclosed
- 2023-12-15: patched: Fixed in v3.11.7