CVE-2024-23340

Executive Summary

CVE-2024-23340 is a path traversal vulnerability in the @hono/node-server adapter, which allows Hono applications to run on Node.js. The vulnerability arises from the custom Request object introduced in version 1.3.0, which fails to resolve double dots (..) in the URL path. This can lead to unauthorized access to files outside the intended directory when using the serveStatic middleware. The CVSS score is 5.3 (Medium), with a low attack complexity and no user interaction required. The vulnerability is patched in version 1.4.1.

Supply Chain & Package Security

This vulnerability affects the npm package @hono/node-server. Users of this package should update to version 1.4.1 or later. The package is widely used in Node.js environments for running Hono applications. The vulnerability is specific to the custom Request object and does not affect standard web browsers or modern curl commands that resolve double dots on the client side.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the potential for unauthorized file access, but the impact is limited to confidentiality.

Deep Dive & Mechanics

The vulnerability is in the @hono/node-server package, which creates a custom Request object. In standard web APIs, when a URL contains .. (double dots), the path is resolved to its canonical form. For example, http://localhost/static/../foo.txt becomes http://localhost/foo.txt. However, the custom Request object in @hono/node-server does not perform this resolution, so the URL remains as http://localhost/static/../foo.txt. This can be exploited when using the serveStatic middleware, which serves static files based on the URL path. An attacker can craft a request with .. to traverse directories and access files outside the intended static directory.

The vulnerability is present in versions 1.3.0 to 1.4.0. The fix in version 1.4.1 resolves double dots in the URL path.

Vulnerable vs. Patched Code

Vulnerable Code (v1.3.0 - v1.4.0):

// In the custom Request object, the url property is set without resolving double dots
class CustomRequest {
  constructor(input, init) {
    this.url = input; // No path resolution
  }
}

Patched Code (v1.4.1):

// The url property now resolves double dots
class CustomRequest {
  constructor(input, init) {
    this.url = new URL(input).pathname; // Resolves double dots
  }
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can send a crafted HTTP request to a Hono application using @hono/node-server with serveStatic middleware. For example:

curl -v "http://target.com/static/../etc/passwd"

If the server does not resolve double dots, it may serve the file /etc/passwd instead of the intended static file.

Blue Team

To detect exploitation attempts, monitor for requests containing .. in the URL path, especially in static file serving endpoints. Use the detection rules provided below.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing .. in the path, e.g., /static/../etc/passwd
• Log Entries: Server logs showing requests with unresolved double dots
• File Access: Unauthorized access to files outside the static directory

Detection Engineering

YARA Rule

rule CVE_2024_23340_Request {
  meta:
    description = "Detects requests with double dots in URL path for CVE-2024-23340"
    author = "Valters IT"
    date = "2024-01-01"
  strings:
    $dotdot = ".."
  condition:
    $dotdot
}

Sigma Rule

title: CVE-2024-23340 Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with double dots in URL path
author: Valters IT
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-query|contains: ".."
  condition: selection
falsepositives:
  - Legitimate use of double dots in URL (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23340 Path Traversal Attempt"; flow:to_server; content:".."; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Update Package: Upgrade @hono/node-server to version 1.4.1 or later.
2. Workaround: If immediate update is not possible, avoid using serveStatic middleware.
3. Input Validation: Implement server-side validation to reject URLs containing ...
4. Web Application Firewall (WAF): Deploy WAF rules to block requests with double dots in the path.

Valters IT
Securing Digital Frontiers