Svelte has a potential mXSS vulnerability due to improper HTML escaping
Affected releases · svelte
- 4.x4.0.0 – 4.2.18Fixed in 4.2.19
- 3.x and older0.0.1 – 3.59.2No fix, no longer updated
On 4.x, the newest line:
npm install svelte@4.2.19Not affected
5.0.0 – 5.57.2
343 releases, latest
Affected
4.0.0 – 4.2.18
28 releases
Fixed
4.2.19 – 4.2.20
2 releases
Affected
3.0.0 – 3.59.2
152 releases
Affected
2.0.0 – 2.16.1
57 releases
Affected
1.0.0 – 1.64.1
178 releases
Affected
0.0.1 – 0.3.0
8 releases
Is your project affected?
Paste your package.json, or type the range you declare for svelte. It is read in your browser and sent nowhere.
What happens
Summary
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Details
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
If the string is an attribute value:
"->"&->&Other characters -> No conversion
Otherwise:
<-><&->&Other characters -> No conversion
The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
PoC
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
Impact
XSS, when using an attribute within a noscript tag