Quick answers
- Is CVE-2023-29008 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-29008 being exploited in the wild.
- How severe is CVE-2023-29008?
- High severity, with a CVSS score of 8.8, published 7 April 2023.
- Which products and versions are affected?
- @sveltejs/kit (npm) < 1.15.2, SEMVER:introduced=0,fixed=1.15.2; SvelteKit < 1.15.2.
- Is there a fix for CVE-2023-29008?
- Yes. @sveltejs/kit (npm): upgrade to 1.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-29008 attacked?
- It is attacked over the network.
- Am I affected by CVE-2023-29008?
- Check whether you run @sveltejs/kit (npm) or SvelteKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @sveltejs/kit (npm): upgrade to 1.15.2 or later
npm install @sveltejs/kit@1.15.2
Technical details
The vulnerability is a case-sensitivity bypass in CSRF protection (CWE-352). SvelteKit's CSRF check validates the Content-Type header against lowercase strings (application/x-www-form-urlencoded, multipart/form-data, text/plain), but attackers can bypass this by using uppercase characters (e.g., "text/plaiN"). The protection also checks the Origin header, but only for matching the server origin. Exploitation requires user interaction (victim must visit a malicious site) and is most effective when auth cookies lack SameSite protection or when targeting browsers with disabled tracking protection. The vulnerability affects all versions prior to 1.15.2, which includes a case-insensitive Content-Type comparison fix.
Affected products
- Svelte SvelteKit < 1.15.2
Identifiers
- CVE-2023-29008
- GHSA-gv7g-x59x-wf8f
Timeline
- 2023-04-06: disclosed
- 2023-04-06: patched: version 1.15.2 released