Cross-Site Scripting in Retool Affected by Malicious SVG Proxying

CVE-2024-58394

What is CVE-2024-58394?

Retool versions prior to 3.88.0 are susceptible to a cross-site scripting vulnerability that can be exploited by unauthenticated attackers. By proxying malicious SVG files through the /api/imageProxy endpoint, attackers can craft URLs that serve harmful SVG content directly from the Retool origin. This executes arbitrary JavaScript in the context of a victim’s session, potentially leading to unauthorized actions and data exposure. The first evidence of exploitation was logged by the Shadowserver Foundation on October 15, 2024, highlighting the urgency for users to update to version 3.88.0 or later.

References