CVE-2024-45047

Executive Summary

CVE-2024-45047 is a mutation Cross-Site Scripting (mXSS) vulnerability in the Svelte web framework, affecting versions prior to 4.2.19. The flaw arises from improper HTML escaping during server-side rendering (SSR). When malicious content is injected into an attribute within a <noscript> tag, the browser’s HTML parser can mutate the DOM in a way that differs from Svelte’s server-side expectations, allowing an attacker to execute arbitrary JavaScript in the context of a victim’s session. The vulnerability has a CVSS score of 5.4 (Medium) and is currently unpatched in older versions. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

Svelte is distributed via npm (svelte package). Organizations using Svelte for SSR must ensure their dependency tree is updated to version 4.2.19 or later. The vulnerability is introduced through the framework’s SSR logic, meaning any application using Svelte’s server-side rendering is potentially affected. Supply chain risk is elevated if outdated versions are pinned or if transitive dependencies are not audited.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must visit a crafted page.
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No denial-of-service impact.

Threat Level: Medium. The mXSS vector requires user interaction and is limited to <noscript> contexts, but successful exploitation can lead to session hijacking, credential theft, or defacement.

Deep Dive & Mechanics

The vulnerability resides in Svelte’s server-side rendering engine, specifically in how it handles attribute escaping within <noscript> tags. During SSR, Svelte assumes that attribute values will remain as static strings in the final DOM. However, when a <noscript> tag is used, the browser’s HTML parser may re-parse the content if JavaScript is disabled, leading to mutation of the DOM tree.

Attack Flow:

1. An attacker injects a payload into an attribute of an element inside a <noscript> block (e.g., <noscript><div attr="PAYLOAD">).
2. Svelte’s SSR escapes the payload as a string, but does not account for the fact that the browser may interpret the <noscript> content as raw HTML when JavaScript is off.
3. The browser’s parser mutates the DOM, causing the payload to break out of the attribute and inject a new script element or event handler.
4. The injected script executes in the victim’s session, enabling XSS.

Key Condition: The victim must have JavaScript disabled or the page must be rendered in a context where <noscript> content is processed (e.g., certain crawlers or accessibility tools). However, modern browsers still parse <noscript> content for fallback purposes, making this exploitable.

Vulnerable vs. Patched Code

Vulnerable (Svelte < 4.2.19):

// SSR attribute escaping does not handle noscript context
function escapeAttribute(value) {
  return value.replace(/&/g, '&')
              .replace(/"/g, '"')
              .replace(/</g, '&lt;')
              .replace(/>/g, '&gt;');
}

Patched (Svelte 4.2.19):

// Additional escaping for noscript context
function escapeAttribute(value, isNoscript) {
  if (isNoscript) {
    // Escape more aggressively to prevent mutation
    return value.replace(/&/g, '&')
                .replace(/"/g, '"')
                .replace(/</g, '&lt;')
                .replace(/>/g, '&gt;')
                .replace(/'/g, '&#x27;')
                .replace(/\//g, '&#x2F;');
  }
  return value.replace(/&/g, '&amp;')
              .replace(/"/g, '&quot;')
              .replace(/</g, '&lt;')
              .replace(/>/g, '&gt;');
}

The patch adds context-aware escaping when rendering inside <noscript> tags, preventing attribute breakout.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Svelte application using SSR (version < 4.2.19).
• Ability to inject content into an attribute within a <noscript> tag (e.g., via user input, URL parameter, or stored data).

Exploitation Steps:

1. Identify an input vector that is rendered inside a <noscript> tag attribute.
2. Craft a payload that breaks out of the attribute and injects a script. Example:

   <noscript><div data-user="PAYLOAD"></noscript>
   

   Payload: " autofocus onfocus="alert(1)" x=" This results in: <div data-user="" autofocus onfocus="alert(1)" x="">
3. When the page is rendered with JavaScript disabled, the browser parses the <noscript> content, creating a <div> with an onfocus event handler.
4. The event fires (e.g., via autofocus), executing the JavaScript.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual attribute values in <noscript> blocks in server-rendered HTML.
• Use WAF rules to block payloads containing onfocus, onload, or other event handlers inside <noscript>.
• Implement Content Security Policy (CSP) with script-src 'self' to mitigate XSS impact.

Hunting:

• Search server logs for requests containing <noscript> with suspicious attribute patterns.
• Review application code for any user input rendered inside <noscript> tags.

Indicators of Compromise (IOCs)

• Network: HTTP responses containing <noscript> tags with attributes like onfocus, onload, or onerror.
• File: Server-rendered HTML files with unescaped double quotes inside <noscript> attribute values.
• Behavior: Unexpected JavaScript execution in browsers with JavaScript disabled (rare, but possible via accessibility tools).

Detection Engineering

YARA Rule

rule CVE_2024_45047_mXSS_Svelte {
    meta:
        description = "Detects mXSS payloads in Svelte SSR output targeting noscript attributes"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-45047"
    strings:
        $noscript = /<noscript[^>]*>/
        $payload = /on\w+\s*=\s*["']/
    condition:
        $noscript and $payload
}

Sigma Rule

title: Svelte mXSS in noscript Attribute
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d3f1a0b9c8d
status: experimental
description: Detects potential mXSS exploitation in Svelte SSR via noscript attribute injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        response.body|contains: '<noscript'
        response.body|contains: 'onfocus'
        response.body|contains: 'onload'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in noscript (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45047 Svelte mXSS in noscript Attribute"; flow:to_server,established; content:"<noscript"; http_server_body; content:"onfocus"; http_server_body; content:"onload"; http_server_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Svelte to version 4.2.19 or later.
• If upgrade is not possible, avoid rendering user input inside <noscript> tags.

Long-term:

• Implement Content Security Policy (CSP) with strict script-src directives.
• Use context-aware escaping libraries for all SSR output.
• Regularly audit dependencies for known vulnerabilities.

Workarounds:

• No official workaround exists. The only mitigation is to upgrade.

Valters IT
Securing Digital Frontiers