Executive brief
Hono is a web application framework used to build servers and APIs. A vulnerability in its static file serving component when used with the Deno runtime allows unauthorized users to access files outside of the intended public folder. This could lead to the exposure of sensitive application source code or configuration files.
Technical details
A path traversal vulnerability (CWE-22) exists in Hono's 'serveStatic' middleware specifically when deployed using the Deno runtime. The root cause is insufficient sanitization of URL-encoded path traversal sequences (e.g., '%2e%2e/') in the request path. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to escape the designated static root directory and retrieve arbitrary files from the server's file system, such as 'main.ts'. The issue is fixed in version 4.2.7 by improving path validation in the Deno-specific middleware implementation.
Affected products
- honojs hono < 4.2.7
Timeline
- 2024-04-23: advisory: GitHub Advisory GHSA-3mpf-rcc7-5347 published
- 2024-04-23: patched: Version 4.2.7 released with fix