CVE-2024-23340: Hono node-server path traversal in URL handling

CVE-2024-23340 · Severity: low · CVSS 3.1 · Published 2024-01-23

Hono's node-server is a JavaScript web server framework used to build Node.js applications. A bug in URL processing failed to resolve "../" (double-dot) path segments, allowing requests with unresolved paths to reach the application. When used with the serveStatic middleware to serve files, this could enable attackers to access files outside the intended directory.

Technologies: Hono Node-Server, @hono/node-server (npm). Vendors: Hono, npm.

Quick answers

Is CVE-2024-23340 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-23340 being exploited in the wild.
How severe is CVE-2024-23340?
Low severity, with a CVSS score of 3.1, published 23 January 2024.
Which products and versions are affected?
Hono Node-Server >=1.3.0 <1.4.1; @hono/node-server (npm) SEMVER:introduced=1.3.0,fixed=1.4.1.
Is there a fix for CVE-2024-23340?
Yes. @hono/node-server (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23340 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-23340?
Check whether you run Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @hono/node-server (npm): upgrade to 1.4.1 or later
    npm install @hono/node-server@1.4.1

Technical details

The vulnerability is a path traversal flaw (CWE-22) in the Request object URL handling introduced in version 1.3.0. Unlike the web standard API which resolves ".." sequences in URLs before processing, @hono/node-server's custom Request implementation passed unresolved paths directly to the application. An attacker can craft a request containing double-dots (e.g., "/static/../foo.txt") that would be normalized by standards-compliant browsers/clients but pass through unresolved when accessed by clients that don't normalize paths. Combined with the serveStatic middleware, this enables directory traversal attacks. The vulnerability requires network access with no authentication or user interaction. The issue was patched in version 1.4.1.

Affected products

  • Hono node-server >=1.3.0 <1.4.1

Identifiers

  • CVE-2024-23340
  • GHSA-rjq5-w47x-x359

Timeline

  • 2024-01-23: disclosed
  • 2024-01-23: patched: Version 1.4.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.