PT-2024-19820 · Unknown · @Hono/Node-Server
Yusukebe
·
Published
2024-01-22
·
Updated
2024-01-30
·
CVE-2024-23340
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
@hono/node-server versions 1.3.0 through 1.4.0
Description
The issue arises from the
url behavior in @hono/node-server's Request object, which does not resolve "double dots" (..) in URLs, potentially leading to vulnerabilities when using serveStatic. This behavior differs from the standard API, where URLs containing .. are resolved to their actual path. For example, http://localhost/static/.. /foo.txt is returned instead of being resolved to http://localhost/foo.txt. This issue may not affect users accessing the application through modern web browsers or the latest curl command, as these tools resolve double dots on the client side. However, problems can occur if the application is accessed by a client that does not resolve double dots.Recommendations
For versions 1.3.0 through 1.4.0, update to version 1.4.1, which includes the fix for this issue.
As a temporary workaround for affected versions, do not use
serveStatic.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Hono/Node-Server