Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04MjY2LTg0d3Atd3Y1Y84AA_Dj

Svelte has a potential mXSS vulnerability due to improper HTML escaping

Summary

A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.

Details

Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:

• If the string is an attribute value:
  • " -> "
  • & -> &
  • Other characters -> No conversion
• Otherwise:
  • < -> <
  • & -> &
  • Other characters -> No conversion

The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.

PoC

A vulnerable page (+page.svelte):

<script>
import { page } from "$app/stores"

// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>

<noscript>
  <a href={href}>test</a>
</noscript>

If a user accesses the following URL,

http://localhost:4173/?href=</noscript><script>alert(123)</script>

then, alert(123) will be executed.

Impact

XSS, when using an attribute within a noscript tag

Permalink: https://github.com/advisories/GHSA-8266-84wp-wv5c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04MjY2LTg0d3Atd3Y1Y84AA_Dj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Identifiers: GHSA-8266-84wp-wv5c, CVE-2024-45047
References:

• https://github.com/sveltejs/svelte/security/advisories/GHSA-8266-84wp-wv5c
• https://github.com/sveltejs/svelte/commit/83e96e044deb5ecbae2af361ae9e31d3e1ac43a3
• https://nvd.nist.gov/vuln/detail/CVE-2024-45047
• https://github.com/advisories/GHSA-8266-84wp-wv5c

Repository: https://github.com/sveltejs/svelte
Blast Radius: 25.7

Affected Packages