PT-2024-31398 · Svelte · Svelte

Arkark · Published 2024-08-30 · Updated 2024-09-25 · CVE-2024-45047

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Svelte versions prior to 4.2.19

Description A potential mXSS vulnerability exists in Svelte due to improper HTML escaping on server-side rendering. The issue arises when the final DOM tree rendered on browsers differs from what Svelte expects, allowing for XSS attacks. This can occur when injecting malicious content into an attribute within a noscript tag. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 4.2.19, upgrade to release version 4.2.19 to address the issue. As a temporary workaround, consider restricting the use of attributes within noscript tags to minimize the risk of exploitation. Avoid using user-inputted values for the href attribute in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45047

GHSA-8266-84WP-WV5C

Affected Products

Svelte

References · 11

• 🔥 https://github.com/sveltejs/svelte/security/advisories/GHSA-8266-84wp-wv5c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45047.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45047 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45047 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8266-84wp-wv5c · Vendor Advisory
• https://github.com/sveltejs/svelte · Note
• https://github.com/sveltejs/svelte/commit/83e96e044deb5ecbae2af361ae9e31d3e1ac43a3 · Note
• https://t.me/cvenotify/92886 · Telegram Post
• https://t.me/cvedetector/4536 · Telegram Post
• https://twitter.com/CVEnew/status/1829568501478006978 · Twitter Post
• https://t.me/cvenotify/96030 · Telegram Post