PT-2023-31617 · Hono · Hono

Yusukebe · Published 2023-12-14 · Updated 2023-12-19 · CVE-2023-50710

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hono versions prior to 3.11.7

Description The issue allows clients to override named path parameter values from previous requests when the application is using TrieRouter. This poses a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter.

Recommendations For versions prior to 3.11.7, update to version 3.11.7 to fix the issue. As a temporary workaround, avoid using TrieRouter directly.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-50710

GHSA-F6GV-HH8J-Q8VQ

Affected Products

Hono

References · 11

• 🔥 https://github.com/honojs/hono/security/advisories/GHSA-f6gv-hh8j-q8vq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50710.json · Exploit
• https://github.com/honojs/hono/commit/8e2b6b08518998783f66d31db4f21b1b1eecc4c8 · Patch
• https://osv.dev/vulnerability/GHSA-f6gv-hh8j-q8vq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50710 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50710 · Security Note
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/releases/tag/v3.11.7 · Note
• https://twitter.com/VulmonFeeds/status/1735380655544975681 · Twitter Post
• https://twitter.com/CVEnew/status/1735354161942716461 · Twitter Post
• https://t.me/cvenotify/64227 · Telegram Post