Executive brief
Hono is a lightweight web framework used to build APIs and web applications in JavaScript. Its CSRF (Cross-Site Request Forgery) protection middleware can be bypassed by attackers who craft HTTP requests with uppercase Content-Type headers, allowing them to perform unauthorized actions on behalf of authenticated users without their knowledge or consent.
Technical details
The Hono CSRF middleware uses a regular expression that only matches lowercase form-related MIME types (application/x-www-form-urlencoded, multipart/form-data, text/plain) when determining whether to enforce CSRF protection. Since MIME types are case-insensitive per HTTP specification, an attacker can bypass the check by sending a POST request with an uppercase variant such as "Application/x-www-form-urlencoded". The vulnerability affects all versions prior to 4.5.8. The attack requires user interaction (the victim must visit a malicious web page that triggers the request) and network reachability. An attacker can achieve unauthorized state modification on the targeted application. A patch is available in version 4.5.8.
Affected products
- Hono Hono < 4.5.8
Timeline
- 2024-08-22: disclosed
- 2024-08-22: patched: Fixed in version 4.5.8