Server-side Request Forgery (SSRF) Affecting @sveltejs/kit package, versions <1.15.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SVELTEJSKIT-5415403
- published 7 Apr 2023
- disclosed 7 Apr 2023
- credit Ry0taK
Introduced: 7 Apr 2023
CVE-2023-29008 Open this link in a new tabHow to fix?
Upgrade @sveltejs/kit to version 1.15.2 or higher.
Overview
@sveltejs/kit is a SvelteKit framework and CLI
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) by allowing malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.
Workaround
It is recommended to explicitly set SameSite to a value other than None on authentication cookies especially if the upgrade cannot be done in a timely manner.