Executive brief
Hono's node-server is a JavaScript web server framework used to build Node.js applications. A bug in URL processing failed to resolve "../" (double-dot) path segments, allowing requests with unresolved paths to reach the application. When used with the serveStatic middleware to serve files, this could enable attackers to access files outside the intended directory.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the Request object URL handling introduced in version 1.3.0. Unlike the web standard API which resolves ".." sequences in URLs before processing, @hono/node-server's custom Request implementation passed unresolved paths directly to the application. An attacker can craft a request containing double-dots (e.g., "/static/../foo.txt") that would be normalized by standards-compliant browsers/clients but pass through unresolved when accessed by clients that don't normalize paths. Combined with the serveStatic middleware, this enables directory traversal attacks. The vulnerability requires network access with no authentication or user interaction. The issue was patched in version 1.4.1.
Affected products
- Hono node-server >=1.3.0 <1.4.1
Timeline
- 2024-01-23: disclosed
- 2024-01-23: patched: Version 1.4.1 released with fix