Executive brief
SvelteKit is a popular web application framework used to build REST APIs and web applications. The framework's built-in CSRF (cross-site request forgery) protection can be bypassed using uppercase characters in HTTP headers, allowing attackers to submit unauthorized requests on behalf of authenticated users. Depending on the site's cookie security settings, this could lead to account compromise or unauthorized operations.
Technical details
The vulnerability is a case-sensitivity bypass in CSRF protection (CWE-352). SvelteKit's CSRF check validates the Content-Type header against lowercase strings (application/x-www-form-urlencoded, multipart/form-data, text/plain), but attackers can bypass this by using uppercase characters (e.g., "text/plaiN"). The protection also checks the Origin header, but only for matching the server origin. Exploitation requires user interaction (victim must visit a malicious site) and is most effective when auth cookies lack SameSite protection or when targeting browsers with disabled tracking protection. The vulnerability affects all versions prior to 1.15.2, which includes a case-insensitive Content-Type comparison fix.
Affected products
- Svelte SvelteKit < 1.15.2
Timeline
- 2023-04-06: disclosed
- 2023-04-06: patched: version 1.15.2 released