CVE-2024-45047
📋 TL;DR
This CVE describes a mutation XSS (mXSS) vulnerability in Svelte's server-side rendering where HTML escaping is improperly handled. Attackers can inject malicious content into attributes within noscript tags, causing browsers to interpret it differently than Svelte expects during server-side rendering. This affects all Svelte applications using server-side rendering up to version 4.2.19.
💻 Affected Systems
- Svelte
📦 What is this software?
Svelte by Svelte
⚠️ Risk & Real-World Impact
Worst Case
Full account takeover, session hijacking, or credential theft through persistent XSS payloads executing in users' browsers.
Likely Case
Limited XSS attacks stealing session cookies or performing actions on behalf of authenticated users.
If Mitigated
No impact if proper Content Security Policies are implemented and input validation/sanitization is in place.
🎯 Exploit Status
Exploitation requires specific conditions with noscript tags and attribute injection during SSR.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.19
Vendor Advisory: https://github.com/sveltejs/svelte/security/advisories/GHSA-8266-84wp-wv5c
Restart Required: Yes
Instructions:
1. Update package.json to specify svelte version 4.2.19 or higher. 2. Run npm update svelte or yarn upgrade svelte. 3. Restart your application server. 4. Rebuild and redeploy your application.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) with script-src directives
- Add additional input validation and output encoding for user-controlled data in noscript attributes
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for svelte version below 4.2.19Check Version:
npm list svelte | grep svelteVerify Fix Applied:
Confirm svelte version is 4.2.19 or higher in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- Unusual attribute values in noscript tags
- Multiple failed attempts to inject script-like content
Network Indicators:
- Unexpected script execution from noscript tag contexts
SIEM Query:
web_logs WHERE request_uri CONTAINS 'noscript' AND (request_body CONTAINS 'javascript:' OR request_body CONTAINS 'onload=' OR request_body CONTAINS 'onerror=')