PT-2023-22079 · Sveltekit · Sveltekit

V1Ktor0T · Published 2023-04-04 · Updated 2023-04-12 · CVE-2023-29003

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SvelteKit versions prior to 1.15.1

Description The SvelteKit framework provides out-of-the-box cross-site request forgery (CSRF) protection. However, prior to version 1.15.1, this protection can be bypassed by specifying a different Content-Type header value, such as text/plain. This allows malicious requests to be submitted from third-party domains, potentially leading to execution of operations within the context of the victim's session and unauthorized access to users' accounts.

Recommendations For SvelteKit versions prior to 1.15.1, update to version 1.15.1 or later to resolve the issue. As a temporary workaround, consider restricting access to API endpoints that handle sensitive operations until the update is applied. Additionally, users who have implemented a ? method= override feature in their handle hook should ensure that their implementation properly validates and handles requests with PUT, PATCH, and DELETE methods.

Exploit

Fix

Incomplete List of Disallowed Inputs

CSRF

Weakness Enumeration

CWE-184

CWE-352

Related Identifiers

CVE-2023-29003

GHSA-5P75-VC5G-8RV2

Affected Products

Sveltekit

References · 8

• 🔥 https://github.com/sveltejs/kit/security/advisories/GHSA-5p75-vc5g-8rv2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29003.json · Exploit
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%401.15.1 · Patch
• https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123 · Patch
• https://osv.dev/vulnerability/CVE-2023-29003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29003 · Security Note
• https://osv.dev/vulnerability/GHSA-5p75-vc5g-8rv2 · Vendor Advisory
• https://github.com/sveltejs/kit · Note