Description
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods.
SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it’s users. The protection is implemented at kit/src/runtime/server/respond.js#L52.
Recommendation
Update the @sveltejs/kit package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.15.1
- Patched version(s): 1.15.1
References
Could your website be exposed too?
SmartScanner can check your website for SvelteKit vulnerable to Cross-Site Request Forgery and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @builder.io/qwik-city Cross-Site Request Forgery vulnerability - CVE-2023-2307
- Axios Cross-Site Request Forgery Vulnerability - CVE-2023-45857
- NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability - CVE-2023-45884
- ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor - CVE-2023-37905
You might also like:
See something that needs correcting? Let us knowUpdated April 06, 2023