CVE-2023-29003 (sveltekit)

SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protection can be bypassed by simply specifying a different `Content-Type` header value. If abused, this issue will allow malicious …

apis attacks box context cross-site cross-site request forgery csrf cve developers development domains endpoint file forgery framework handlers header http job malicious operations party protection request requests rest rest apis server simple sveltekit third third-party value version version 1 web web development