CSRF Middleware Bypass in Hono Web Application Framework by Hono

CVE-2024-43787

What is CVE-2024-43787?

The Hono Web Application Framework is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability due to a flaw in its CSRF middleware. An attacker can exploit this vulnerability by crafting a malicious Content-Type header that uses an upper-case MIME type. As the matching mechanism for the CSRF protection does not differentiate between upper-case and lower-case MIME types, it allows the attacker to bypass the security checks and launch a CSRF attack. This issue was addressed in version 4.5.8 of the Hono framework.

References