CVE-2024-23340: @hono/node-server can't handle "double dots" in URL
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request will be in the resolved path. However, the url in @hono/node-server's Request as does not resolve double dots, so http://localhost/static/.. /foo.txt is returned. This causes vulnerabilities when using serveStatic. Modern web browsers and a latest curl command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use serveStatic.
Other sources
Impact
Since v1.3.0, we use our own Request object. This is great, but the url behavior is unexpected.
In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request will be in the resolved path.
ts const req = new Request('http://localhost/static/../foo.txt') // Web-standards console.log(req.url) // http://localhost/foo.txt
However, the url in our Request does not resolve double dots, so http://localhost/static/.. /foo.txt is returned.
ts const req = new Request('http://localhost/static/../foo.txt') console.log(req.url) // http://localhost/static/../foo.txt
It will pass unresolved paths to the web application. This causes vulnerabilities like #123 when using serveStatic.
Note: Modern web browsers and a latest curl command resolve double dots on the client side, so it does not affect you if the user uses them. However, problems may occur if accessed by a client that does not resolve them.
Patches
"v1.4.1" includes the change to fix this issue.
Workarounds
Don't use serveStatic.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@hono/node-serverto a version that resolves this vulnerability.Fixed in 1.4.1 - Upgrade
Upgrade
@hono/node-serverto a version that resolves this vulnerability.Fixed in 1.4.1 - Configuration
As a workaround, do not use `serveStatic` with @hono/node-server until upgrading to v1.4.1, because @hono/node-server can't handle
@hono/node-server (serveStatic) serveStatic usage = do not use
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23340?
CVE-2024-23340 has been rated as a moderate severity vulnerability due to its potential to allow unauthorized access.
How do I fix CVE-2024-23340?
To fix CVE-2024-23340, upgrade @hono/node-server to version 1.4.1 or later.
Which versions of @hono/node-server are affected by CVE-2024-23340?
Versions of @hono/node-server from 1.3.0 to 1.4.0 are affected by CVE-2024-23340.
What type of issue is CVE-2024-23340?
CVE-2024-23340 is related to improper URL handling which could lead to security vulnerabilities in applications.
Who is affected by CVE-2024-23340?
Developers using versions of @hono/node-server between 1.3.0 and 1.4.0 on Node.js are affected by CVE-2024-23340.