CVE-2025-58362

Executive Summary

CVE-2025-58362 is a path confusion vulnerability in the Hono web application framework, affecting versions 4.8.0 through 4.9.5. The flaw resides in the getPath utility function, which incorrectly parses certain malformed absolute-form Request-URIs by relying on fixed character offsets. This can lead to incorrect path extraction, potentially allowing an attacker to bypass proxy-level Access Control Lists (ACLs), such as Nginx location blocks. If sensitive endpoints like /admin are protected by such ACLs, an attacker could gain unauthorized access. The vulnerability has a CVSS score of 7.5 (High) and is fixed in version 4.9.6.

Supply Chain & Package Security

Hono is distributed via npm as the hono package. Organizations using Hono in their JavaScript/TypeScript runtimes (Node.js, Deno, Bun, Cloudflare Workers) should immediately audit their dependency trees for affected versions. The vulnerability is introduced in the source code and does not involve a compromised package registry; however, the risk of supply chain propagation exists if applications bundle vulnerable versions. Ensure that package.json and lock files are updated to >=4.9.6.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the low attack complexity and potential for unauthorized access to sensitive administrative endpoints.

Deep Dive & Mechanics

The vulnerability exists in the getPath function within Hono's routing logic. When processing incoming HTTP requests, Hono extracts the path from the request URL to match against defined routes. The function uses fixed character offsets to parse absolute-form Request-URIs (e.g., GET http://example.com/admin HTTP/1.1). However, by crafting a malformed absolute-form URI—such as including extra characters or manipulating the scheme/host portion—an attacker can cause the offset-based parsing to extract an incorrect path.

For example, a request like:

GET http://example.com:80@evil.com/admin HTTP/1.1

might be parsed by Hono as /admin (the intended path), but due to the offset flaw, it could be interpreted as /evil.com/admin or another path, bypassing proxy ACLs that rely on path matching. This is particularly dangerous when reverse proxies (e.g., Nginx) use location blocks to restrict access to sensitive paths, as the proxy may forward the request to Hono with a different path than what Hono internally processes.

The root cause is the use of hardcoded offsets (e.g., skipping a fixed number of characters after http://) without validating the structure of the URI. The fix in version 4.9.6 implements proper URI parsing that accounts for variations in the absolute-form.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example from version 4.8.0-4.9.5):

function getPath(url) {
  // Assume absolute-form URI starts with "http://" or "https://"
  const start = url.startsWith('https://') ? 8 : 7; // fixed offset
  const end = url.indexOf('/', start);
  return url.substring(end);
}

Patched Code (version 4.9.6):

function getPath(url) {
  // Properly parse the URI using URL constructor
  try {
    const parsed = new URL(url);
    return parsed.pathname;
  } catch {
    // Fallback for relative URIs
    return url;
  }
}

The patched version uses the standard URL constructor to correctly extract the pathname, eliminating the reliance on fixed offsets.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Hono 4.8.0 to 4.9.5 behind a reverse proxy (e.g., Nginx) with ACLs protecting /admin.
• Network access to the proxy.

Exploitation Steps:

1. Identify the target's Hono version (e.g., via error messages or response headers).
2. Craft a malformed absolute-form Request-URI that bypasses the proxy's ACL but is incorrectly parsed by Hono.
3. Send the request using curl:

   curl -v -X GET "http://target.com:80@evil.com/admin" -H "Host: target.com"
   

4. Observe if the response returns the admin page or sensitive data.

Expected Outcome: The proxy may see the path as /evil.com/admin (not matching its ACL), but Hono's vulnerable getPath extracts /admin, granting access.

Blue Team

Detection:

• Monitor for unusual request URIs containing @ characters or multiple hostnames.
• Look for requests where the Host header does not match the URI authority.
• Analyze proxy logs for requests that bypass location blocks.

Hunting Query (Splunk):

index=proxy_logs uri="*@*" AND method=GET
| eval parsed_path = replace(uri, "^http://[^/]+", "")
| search parsed_path IN ("/admin", "/config", "/api/secret")

Mitigation:

• Immediately upgrade Hono to version 4.9.6 or later.
• Implement additional validation at the proxy level (e.g., reject malformed URIs).
• Use Web Application Firewall (WAF) rules to block requests with @ in the URI.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with URIs containing @ before the path (e.g., http://example.com:80@evil.com/admin).
  • Requests where the URI scheme/host differs from the Host header.
• Log IOCs:
  • Proxy logs showing 200 OK responses for paths that should be blocked by ACLs.
  • Application logs with unusual path extraction warnings (if logging is enabled).
• File IOCs:
  • Hono package version in package.json or lock files: >=4.8.0 and <4.9.6.

Detection Engineering

YARA Rule

rule CVE_2025_58362_Hono_Path_Confusion {
    meta:
        description = "Detects Hono versions vulnerable to CVE-2025-58362 path confusion"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-58362"
    strings:
        $vuln_func = "getPath" ascii wide nocase
        $vuln_offset = "startsWith('https://')" ascii wide
        $vuln_substr = "substring" ascii wide
    condition:
        $vuln_func and ($vuln_offset or $vuln_substr)
}

Sigma Rule

title: CVE-2025-58362 Hono Path Confusion Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-58362 via malformed absolute-form URIs
author: Valters IT
date: 2025-04-10
logsource:
    category: proxy
    product: nginx
detection:
    selection:
        request_uri|contains: '@'
        request_method: 'GET'
    condition: selection
falsepositives:
    - Legitimate use of credentials in URI (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58362 Hono Path Confusion Attempt"; flow:to_server; http.uri; content:"@"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Upgrade: Update Hono to version 4.9.6 or later. Run:

   npm install hono@4.9.6
   

2. Proxy Hardening: Configure reverse proxies to reject malformed URIs. For Nginx, add:

   if ($request_uri ~* "@") {
       return 400;
   }
   

3. WAF Rules: Deploy WAF rules to block requests with @ in the URI path.
4. Monitoring: Enable logging of all request URIs and alert on anomalies.
5. Vendor Advisory: Monitor Hono's GitHub for future security updates.

Valters IT
Securing digital frontiers with precision.