Listen to this Post
The vulnerability exploits improper Host header validation in SvelteKit’s prerendering and adapter-node logic. When an application with prerendered routes (export const prerender = true) uses `adapter-node` and lacks a configured `ORIGIN` environment variable, it fails to validate the incoming HTTP `Host` header. An attacker can send a request with a malicious `Host` header pointing to an internal service or a server they control. SvelteKit’s server runtime, during prerendering or request handling, uses this untrusted `Host` value to construct absolute URLs for fetch operations or redirects, leading to Server-Side Request Forgery (SSRF). This allows the attacker to probe or attack internal network services accessible from the SvelteKit server. For a Denial-of-Service (DoS), a specifically malformed `Host` header can cause the Node.js process to crash. Furthermore, by poisoning the CDN cache with a malicious response from a controlled server, an attacker can achieve Stored Cross-Site Scripting (SXSS) for users served the poisoned cache entry.
Platform: SvelteKit
Version: >=2.19.0
Vulnerability: SSRF/DoS
Severity: Critical
Date: 2024-04-09
Prediction: 2024-04-30
What Undercode Say:
Check SvelteKit version in package.json grep '"sveltekit"' package.json Check for prerender configuration grep -r "prerender.true" src/ Check if adapter-node is used grep '"@sveltejs/adapter-node"' package.json Simulate vulnerable request with curl curl -H "Host: http://attacker-controlled.internal" http://target-app.com/prerendered-route Environment variable check echo $ORIGIN
How Exploit:
Crafting HTTP request with malicious Host header GET /prerendered-route HTTP/1.1 Host: 169.254.169.254:80 Triggering DoS with malformed header GET / HTTP/1.1 Host: [::]:80
Protection from this CVE
Set the `ORIGIN` environment variable explicitly in production. Deploy behind a reverse proxy (e.g., Nginx, Caddy) that validates and strips invalid `Host` headers. Update SvelteKit to a patched version immediately upon release.
Impact:
Application Denial-of-Service. Internal network SSRF. Potential Cache Poisoning leading to Stored XSS.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
