Description
SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | kit | < 3.0.0 | 3.0.0 |
References
- GitHub Security Advisory (GHSA-prjg-x2qj-wj3g) vendor-advisory
- VulnCheck Advisory: SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks third-party-advisory