Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious… (CVE-2024-58394)

CVE-2024-58394 describes a cross-site scripting vulnerability in Retool prior to version 3.88.0. The flaw allows unauthenticated attackers to execute arbitrary JavaScript by proxying malicious SVG files through the /api/imageProxy endpoint. The attacker-hosted SVG is served from the Retool origin without any Content Security Policy, enabling script execution in users' sessions. This vulnerability was publicly observed in exploitation attempts by the Shadowserver Foundation in October 2024. The CVSS 3.1 score is 6.1 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact without availability impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the Retool web application for affected users. This can lead to partial confidentiality and integrity loss within the victim's session, such as theft of session tokens or manipulation of displayed data. There is no direct impact on availability. The vulnerability affects the security boundary of the application by enabling script execution from the Retool origin.

A fix is available in Retool version 3.88.0 and later. Users should upgrade to version 3.88.0 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Until upgrading, users should be cautious about untrusted SVG content and consider restricting access to the /api/imageProxy endpoint if possible.