Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2023-29003: SvelteKit allows CSRF bypass before 1.15.1
CVE-2023-29003 · published 3 years ago
Summary
The SvelteKit web framework could let attackers send forged requests from other sites by using an unexpected Content-Type header. This could let malicious actions run under a logged‑in user’s session, potentially exposing account data. Upgrade to SvelteKit version 1.15.1 or later, which tightens the check and adds protection for additional request methods.
What to do
- Update sveltejs kit to version 1.15.1.
- Update svelte sveltekit to version 1.15.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | sveltejs | kit |
< 1.15.1 Fix: upgrade to 1.15.1
|
| – | svelte | sveltekit |
< 1.15.1 cpe:2.3:a:svelte:sveltekit:*:*:*:*:*:node.js:*:* |
Original advisory text
SvelteKit has Insufficient Cross-Site Request Forgery Protection
SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.
SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protection can be bypassed by simply specifying a different `Content-Type` header value.
If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.
SvelteKit 1.15.1 updates the `is_form_content_type` function call in the CSRF protection logic to include `text/plain`. As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on `PUT`, `PATCH` and `DELETE` methods as well. This latter hardening is only needed to protect users who have put in some sort of `?_method= override` feature themselves in their `handle` hook, so that the request that resolve sees could be `PUT`/`PATCH`/`DELETE` when the browser issues a `POST` request.
SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protection can be bypassed by simply specifying a different `Content-Type` header value.
If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.
SvelteKit 1.15.1 updates the `is_form_content_type` function call in the CSRF protection logic to include `text/plain`. As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on `PUT`, `PATCH` and `DELETE` methods as well. This latter hardening is only needed to protect users who have put in some sort of `?_method= override` feature themselves in their `handle` hook, so that the request that resolve sees could be `PUT`/`PATCH`/`DELETE` when the browser issues a `POST` request.
References
- https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%401.15.1 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29003... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-29003 Vendor Advisory
- https://github.com/advisories/GHSA-5p75-vc5g-8rv2
- https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123 Patch
- https://github.com/sveltejs/kit/security/advisories/GHSA-5p75-vc5g-8rv2 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-184Incomplete List of Disallowed Inputs
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published4 Apr 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta