Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Summary Bypass CSRF Middleware by a request without Content-Type herader. Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe...

@backan/core (>=0.0.3, <=0.1.0), @bepp/api (>=1.3.2, <=1.3.17) +50 more potentially affected by CVE-2024-48913 via hono (>=4.0.0, <=4.6.4)

hono NPM version =4.0.0, =0.0.3, =1.3.2, =0.75.0, =2.1.5, =0.1.0, =1.0.0, =2.13.0, =1.2.0, =1.0.1, =0.0.1, =1.0.0-apm.0, =0.0.0-next-20240721155721, =0.1.0, =0.3.0 and more Source cves: CVE-2024-48913 Source advisory: OSV:GHSA-2234-FMW7-43WR...

GHSA-2234-FMW7-43WR Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Summary Bypass CSRF Middleware by a request without Content-Type herader. Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe...

CVE-2024-48913

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...

CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...

CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...

CVE-2024-48913

Hono (web framework) before version 4.6.5 is vulnerable to CSRF protection bypass: the csrf middleware treats a request without a Content-Type header as safe, allowing an attacker to bypass CSRF protection. Impact is arthritic to user actions guarded by CSRF middleware, with reported CVSS 5.9 (Me...

Hono 跨站请求伪造漏洞

Hono is a web framework written in TypeScript from the Hono community. A cross-site request forgery vulnerability exists in Hono prior to version 4.6.5, which stems from a lack of cross-site request forgery checks...

Cross-Site Request Forgery (CSRF)

Hono is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF middleware's case sensitivity in MIME type matching, which allows bypassing protection with upper-case MIME types...

GHSA-RPFR-3M35-5VX5 Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary Hono CSRF middleware can be bypassed using crafted Content-Type header. Details MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.tsL16-L17 As a...

Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary Hono CSRF middleware can be bypassed using crafted Content-Type header. Details MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.tsL16-L17 As a...

@backan/core (>=0.0.3, <=0.0.19), @bepp/api (>=1.3.2, <=1.3.17) +39 more potentially affected by CVE-2024-43787 via hono (>=4.0.0, <=4.5.7)

hono NPM version =4.0.0, =0.0.3, =1.3.2, =2.1.5, =0.1.0, =1.0.0, =2.13.0, =1.2.0, =1.0.1, =0.0.1, =1.0.0-apm.0, =0.0.0-next-20240721155721, =0.1.0, =0.82.2-rc.1, =0.82.2-rc.1, =0.96.0 and more Source cves: CVE-2024-43787 Source advisory: OSV:GHSA-RPFR-3M35-5VX5...

CVE-2024-43787

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787

CVE-2024-43787: Hono CSRF middleware can be bypassed via crafted Content-Type header due to MIME-type matching only lower-case isRequestedByFormElementRe; this allows bypass of CSRF protection. Affected: Hono prior to 4.5.8. Impact per sources: CSRF protection bypass (low/partial impact described...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

PT-2024-30656 · Hono · Hono

Name of the Vulnerable Software and Affected Versions: Hono versions prior to 4.5.8 Description: The Hono CSRF middleware can be bypassed using a crafted Content-Type header. This is due to the fact that MIME types are case insensitive, but the isRequestedByFormElementRe function only matches...

Hono 安全漏洞

Hono is a web framework written in TypeScript from the Hono community. A security vulnerability exists in Hono versions prior to 4.5.8, which stems from the ability to bypass CSRF middleware using a specially crafted Content-Type header...

Path Traversal

Hono is vulnerable to Path Traversal. The vulnerability is caused due due to a lack of proper path validation when using serveStatic with Deno. This allows an attacker to access unintended files through directory traversal, potentially leading to unauthorized data exposure or manipulation...