Executive brief
SvelteKit is a popular web application framework used to build REST APIs and server endpoints. The framework includes built-in CSRF protection to prevent attackers from tricking users into submitting unwanted requests; however, this protection can be bypassed by using a text/plain Content-Type header, allowing attackers to perform unauthorized actions within a victim's session or account.
Technical details
SvelteKit's CSRF protection (in kit/src/runtime/server/respond.js#L52) validates POST requests from cross-origin sources by checking the Origin header and Content-Type. The vulnerability exists in the is_form_content_type validation function (kit/src/utils/http.js#L71), which only blocks requests with Content-Type values of application/x-www-form-urlencoded or multipart/form-data. An attacker can bypass this protection by sending a cross-origin POST request with Content-Type: text/plain, which will pass the validation and be processed by the endpoint handler. This allows execution of operations within the context of the victim's authenticated session, potentially leading to account compromise. SvelteKit 1.15.1 patches the vulnerability by expanding the blocked Content-Type list to include text/plain and adding validation for PUT, PATCH, and DELETE methods to harden the protection against potential method-override attacks.
Affected products
- Svelte @sveltejs/kit < 1.15.1
Timeline
- 2023-04-04: disclosed: Advisory GHSA-5p75-vc5g-8rv2 published
- 2023-04-04: patched: SvelteKit 1.15.1 released with fix