CVE-2024-58394: Retool 3.88.0 XSS via /api/imageProxy SVG Proxying
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Retool deployments running versions before 3.88.0 should be prioritized, particularly where users can be induced to open attacker-controlled links or content in their browsers.
Does exploitation require an authenticated Retool account?
No. The vulnerability can be exploited by an unauthenticated attacker, but successful script execution occurs in the session of a victim who accesses the attacker-supplied SVG through the affected endpoint.
Has this issue been observed being exploited?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.