CVE-2023-29008 (sveltekit)

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at `kit/src/runtime/server/respond.js`. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed in versions prior to 1.15.2 by simply specifying an upper-cased `Content-Type` header value. The browser will not send uppercase …

apis attacks block box browser characters check cors cross-site cross-site request forgery csrf cve developers endpoint file forgery framework handlers header http job kit malicious protection request requests respond rest rest apis runtime send server simple sveltekit value