GHSA-2234-FMW7-43WR Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Summary Bypass CSRF Middleware by a request without Content-Type herader. Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe...

CVE-2024-48913

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...

CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...

CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...

CVE-2024-48913

Hono (web framework) before version 4.6.5 is vulnerable to CSRF protection bypass: the csrf middleware treats a request without a Content-Type header as safe, allowing an attacker to bypass CSRF protection. Impact is arthritic to user actions guarded by CSRF middleware, with reported CVSS 5.9 (Me...

Hono 跨站请求伪造漏洞

Hono is a web framework written in TypeScript from the Hono community. A cross-site request forgery vulnerability exists in Hono prior to version 4.6.5, which stems from a lack of cross-site request forgery checks...

Cross-Site Request Forgery (CSRF)

Hono is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF middleware's case sensitivity in MIME type matching, which allows bypassing protection with upper-case MIME types...

GHSA-RPFR-3M35-5VX5 Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary Hono CSRF middleware can be bypassed using crafted Content-Type header. Details MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.tsL16-L17 As a...

Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary Hono CSRF middleware can be bypassed using crafted Content-Type header. Details MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.tsL16-L17 As a...

@backan/core (>=0.0.3, <=0.0.19), @bepp/api (>=1.3.2, <=1.3.17) +39 more potentially affected by CVE-2024-43787 via hono (>=4.0.0, <=4.5.7)

hono NPM version =4.0.0, =0.0.3, =1.3.2, =2.1.5, =0.1.0, =1.0.0, =2.13.0, =1.2.0, =1.0.1, =0.0.1, =1.0.0-apm.0, =0.0.0-next-20240721155721, =0.1.0, =0.82.2-rc.1, =0.82.2-rc.1, =0.96.0 and more Source cves: CVE-2024-43787 Source advisory: OSV:GHSA-RPFR-3M35-5VX5...

CVE-2024-43787

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787

CVE-2024-43787: Hono CSRF middleware can be bypassed via crafted Content-Type header due to MIME-type matching only lower-case isRequestedByFormElementRe; this allows bypass of CSRF protection. Affected: Hono prior to 4.5.8. Impact per sources: CSRF protection bypass (low/partial impact described...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware...

PT-2024-30656 · Hono · Hono

Name of the Vulnerable Software and Affected Versions: Hono versions prior to 4.5.8 Description: The Hono CSRF middleware can be bypassed using a crafted Content-Type header. This is due to the fact that MIME types are case insensitive, but the isRequestedByFormElementRe function only matches...

Hono 安全漏洞

Hono is a web framework written in TypeScript from the Hono community. A security vulnerability exists in Hono versions prior to 4.5.8, which stems from the ability to bypass CSRF middleware using a specially crafted Content-Type header...

Path Traversal

Hono is vulnerable to Path Traversal. The vulnerability is caused due due to a lack of proper path validation when using serveStatic with Deno. This allows an attacker to access unintended files through directory traversal, potentially leading to unauthorized data exposure or manipulation...

CVE-2024-32869

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where main.ts is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for t...

CVE-2024-32869 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where main.ts is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for t...