PT-2024-30656 · Hono · Hono
Wataru-Chocola
·
Published
2024-08-22
·
Updated
2025-09-17
·
CVE-2024-43787
CVSS v3.1
5.0
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Hono versions prior to 4.5.8
Description
The Hono CSRF middleware can be bypassed using a crafted Content-Type header. This is due to the fact that MIME types are case insensitive, but the
isRequestedByFormElementRe function only matches lower-case MIME types. As a result, an attacker can bypass the CSRF middleware using an upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".Recommendations
For versions prior to 4.5.8, update to version 4.5.8 to fix the vulnerability. As a temporary workaround, consider modifying the
isRequestedByFormElementRe function to match MIME types in a case-insensitive manner. Restrict access to the CSRF middleware to minimize the risk of exploitation. Avoid using upper-case form-like MIME types in the Content-Type header until the issue is resolved.Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hono