CVE-2024-32869

Executive Summary

CVE-2024-32869 is a path traversal vulnerability in the Hono web application framework, specifically affecting the serveStatic middleware when used with the Deno runtime. The flaw allows an attacker to traverse directories outside the intended static file root, potentially exposing sensitive files such as configuration, source code, or credentials. The vulnerability is rated with a CVSS score of 5.3 (Medium) and affects versions prior to 4.2.7. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for unpatched deployments.

Supply Chain & Package Security

Hono is an npm package (hono) used across JavaScript runtimes including Deno, Node.js, and Bun. The vulnerability is specific to the Deno runtime's serveStatic implementation. Organizations using Hono with Deno should verify their dependency version and update to 4.2.7 or later. The npm ecosystem's supply chain risk is mitigated by the availability of a patch, but users must ensure they are not pinned to an older version.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited file disclosure is possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability allows directory traversal but only within the directory where main.ts resides, limiting the blast radius. No public exploit code is available, and EPSS is 0.0%.

Deep Dive & Mechanics

The vulnerability exists in the serveStatic middleware of Hono when used with Deno. The middleware is designed to serve static files from a specified directory. However, due to insufficient input validation, an attacker can inject path traversal sequences (e.g., ../) into the URL to escape the intended directory.

Root Cause: The serveStatic function does not properly sanitize or normalize the requested path before resolving it against the file system. In Deno, the file system API (Deno.readFile or similar) is used directly, and without proper checks, ../ sequences are resolved relative to the current working directory (where main.ts is located).

Attack Vector: An attacker sends a crafted HTTP request to the server, such as:

GET /../../../etc/passwd HTTP/1.1

If the server is configured to serve static files from a subdirectory, this request could retrieve files outside that directory.

Impact: Unauthorized disclosure of files within the same directory as main.ts or its parent directories. This could include configuration files, environment variables, source code, or other sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Hono < 4.2.7):

// Simplified vulnerable serveStatic implementation
import { serveStatic } from 'hono/deno';
app.use('/static/*', serveStatic({ root: './public' }));
// No path normalization or traversal check

Patched Code (Hono >= 4.2.7):

// Patched serveStatic with path normalization
import { serveStatic } from 'hono/deno';
app.use('/static/*', serveStatic({ root: './public' }));
// The patch adds path traversal detection and normalization
// e.g., using path.resolve and checking for '..' sequences

The patch introduces path normalization using path.resolve and rejects requests containing .. or absolute paths. The exact fix can be found in the Hono GitHub repository commit associated with version 4.2.7.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install Deno and create a simple Hono app:

   deno init myapp
   cd myapp
   

2. Add Hono 4.2.6 (vulnerable) to deps.ts:

   export { Hono } from 'https://deno.land/x/hono@v4.2.6/mod.ts';
   export { serveStatic } from 'https://deno.land/x/hono@v4.2.6/deno/serve-static.ts';
   

3. Create main.ts:

   import { Hono } from './deps.ts';
   import { serveStatic } from './deps.ts';
   const app = new Hono();
   app.use('/static/*', serveStatic({ root: './public' }));
   Deno.serve(app.fetch);
   

4. Create a public directory with a test file (test.txt).
5. Run the server: deno run --allow-net --allow-read main.ts

Exploit:

curl "http://localhost:8000/static/../../../main.ts"

This will retrieve the main.ts file if the traversal is successful.

Blue Team (Detection & Defense)

• Detection: Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f).
• Defense: Apply the patch by upgrading to Hono 4.2.7 or later. Additionally, implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Honeypot: Deploy a decoy file (e.g., config.json) in the static directory to detect traversal attempts.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing ../ or URL-encoded variants (%2e%2e%2f) in the path.
• File System: Unexpected access to files outside the intended static directory (e.g., /etc/passwd, main.ts, .env).
• Logs: Web server logs showing 200 responses for paths with ../ sequences.

Detection Engineering

YARA Rule

rule CVE_2024_32869_Hono_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Hono serveStatic on Deno"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-32869"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
    condition:
        any of ($traversal*)
}

Sigma Rule

title: CVE-2024-32869 Hono Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal patterns in HTTP requests targeting Hono serveStatic
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of '..' in some applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32869 Hono Path Traversal Attempt"; flow:to_server,established; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Hono to version 4.2.7 or later.

   # For npm
   npm install hono@4.2.7
   # For Deno, update import URL
   

2. Workaround: If upgrading is not possible, implement a reverse proxy (e.g., Nginx) to block path traversal patterns:

   location /static/ {
       if ($uri ~* "\.\.") {
           return 403;
       }
   }
   

3. Monitoring: Enable detailed logging and alert on path traversal patterns.
4. Least Privilege: Run the Deno process with minimal file system permissions (e.g., --allow-read=/path/to/public).

Valters IT
DevSecOps & Cyber Threat Intelligence