Executive brief
Hono is a web framework used to build applications and APIs. A security flaw in its built-in protection against Cross-Site Request Forgery (CSRF) allows attackers to bypass security checks if a request is sent without a specific technical label (the Content-Type header). This could allow an attacker to trick a logged-in user into performing unintended actions on a website, potentially leading to unauthorized data changes or account compromise.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Hono's CSRF middleware. The root cause is an insufficient validation logic where the middleware incorrectly assumes any request lacking a 'Content-Type' header is safe. An attacker can exploit this by crafting a cross-origin POST request (e.g., using the fetch API with a Blob body or no body) that omits the Content-Type header, thereby bypassing the middleware's origin and type checks. This allows for unauthorized state-changing operations if the victim is authenticated via cookies. The issue is fixed in version 4.6.5 by ensuring requests without the header are properly scrutinized.
Affected products
- honojs hono < 4.6.5
Timeline
- 2024-10-15: disclosed
- 2024-10-15: patched: Fixed in version 4.6.5
- 2024-10-15: advisory