CVE-2023-29008: 
JavaScript vulnerability analysis and mitigation

The SvelteKit framework's cross-site request forgery (CSRF) protection vulnerability (CVE-2023-29008) was discovered in versions prior to 1.15.2. The vulnerability exists in the framework's REST API implementation, specifically in the CSRF protection mechanism implemented at kit/src/runtime/server/respond.js. The issue was disclosed on April 6, 2023, affecting all SvelteKit installations before version 1.15.2 (GitHub Advisory).

The vulnerability stems from an implementation flaw in the CSRF protection mechanism where the protection can be bypassed by specifying an upper-cased Content-Type header value. While the framework checks Content-Type headers against form content types (application/x-www-form-urlencoded, multipart/form-data, or text/plain), the comparison is case-sensitive. This allows attackers to bypass the protection by using upper-case characters in the Content-Type header, as browsers accept such variations. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows malicious requests to be submitted from third-party domains, enabling operations to be executed within the context of the victim's session. This can lead to unauthorized access to users' accounts, particularly affecting POST operations requiring authentication. The impact is especially severe in scenarios where the target site sets SameSite=None on its auth cookie and users visit malicious sites in Chromium-based browsers, or when the SameSite attribute isn't explicitly set and users visit malicious sites with Firefox/Safari with tracking protections disabled (GitHub Advisory).

The primary mitigation is to upgrade to SvelteKit version 1.15.2 or later, which contains the patch for this vulnerability. For cases where immediate upgrade isn't possible, it's recommended to explicitly set the SameSite attribute to a value other than None on authentication cookies. The patch implements case-insensitive comparison when checking header values (GitHub Advisory, FortiGuard).