Open Redirect in SvelteKit via Enhanced Form Actions

Executive Summary

This is an open redirect vulnerability in SvelteKit versions before 3.0.0. It affects enhanced form actions using use:enhance on routes that accept paths starting with //. Attackers can craft action paths beginning with // which become protocol-relative URLs. This causes non-redirect form results to navigate users to attacker-controlled sites instead of the intended destination.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SvelteKit application uses enhanced form actions (use:enhance) and if any routes accept paths starting with //. Inspect server logs for requests with paths beginning with // targeting form actions. Review application code for catch-all routes or path handling that may allow protocol-relative URLs.

Useful 0 Not Useful 0

Impact Analysis

If you use SvelteKit versions before 3.0.0 with enhanced form actions on routes accepting // paths, attackers could redirect users to malicious sites. This may lead to phishing attacks, credential theft, or malware distribution. Users might unknowingly submit sensitive data to attacker-controlled endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches by redirecting users to malicious sites, potentially exposing personal or sensitive data. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if such data is compromised through the redirect.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SvelteKit to version 3.0.0 or later to patch the vulnerability. As a temporary workaround, reject requests with paths starting with // before route resolution or disable navigation for non-redirect enhanced form results by using a custom submission callback.

Useful 0 Not Useful 0