Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Summary
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Original description
The description as published by the source.
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (hono/aws-lambda) behind an Application Load Balancer (ALB), the getConnInfo() function incorrectly selected the first value from the X-Forwarded-For header. Because AWS ALB appends the real client IP address to the end of the X-Forwarded-For header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the ipRestriction middleware) to be bypassed. Version 4.12.2 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com