Hono CORS Middleware Vary Header Reflection Vulnerability

Mitigation Strategies

To mitigate this vulnerability, upgrade Hono to version 4.10.3 or later, where the flaw in the CORS middleware has been fixed.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Hono versions before 4.10.2 and is fixed in 4.10.3. It is related to the CORS middleware, which incorrectly handles the Vary header. When the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Since the Vary header is a response header that should be controlled by the server, an attacker can supply arbitrary Vary values that get reflected in the response.

This flaw can lead to cache key pollution and inconsistent enforcement of CORS policies, especially in environments that use shared caches or proxies.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause cache key pollution, meaning that attackers can manipulate cache behavior by injecting arbitrary Vary header values. This can result in inconsistent CORS enforcement, potentially allowing unauthorized cross-origin requests to succeed or legitimate requests to be blocked incorrectly.

In environments relying on shared caches or proxies, this inconsistency can lead to security risks such as data leakage or unauthorized access due to improper CORS policy enforcement.

Useful 0 Not Useful 0