Vulnerability · Published Apr 23, 2024 · Assigned by GitHub_M
CVE-2024-32869Hono vulnerable to Restricted Directory Traversal in serveStatic with deno
Medium 5.3
In plain English
A medium-severity path traversal in hono from honojs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 49.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | hono | 4.2.7 | GHSA-3mpf-rcc7-5347 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347 x_refsource_CONFIRM
- https://github.com/honojs/hono/commit/92e65fbb6e5e7372650e7690dbd84938432d9e65 x_refsource_MISC