CVE-2022-1711
📋 TL;DR
This Server-Side Request Forgery (SSRF) vulnerability in draw.io allows attackers to make unauthorized requests from the server to internal systems. It affects users of draw.io versions prior to 18.0.5 who process untrusted diagram files. Attackers can exploit this by crafting malicious diagram files that trigger internal network requests.
💻 Affected Systems
- draw.io
📦 What is this software?
Drawio by Diagrams
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network services, data exfiltration from internal systems, or lateral movement to other servers via the draw.io server's network position.
Likely Case
Information disclosure from internal services, scanning of internal network resources, or limited data extraction from accessible internal endpoints.
If Mitigated
Limited impact due to network segmentation, egress filtering, or restricted server permissions preventing access to sensitive internal resources.
🎯 Exploit Status
Exploitation requires the victim to process a malicious diagram file. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.0.5 and later
Vendor Advisory: https://github.com/jgraph/drawio/commit/cf5c78aa0f3127fb10053db55b39f3017a0654ae
Restart Required: Yes
Instructions:
1. Update draw.io to version 18.0.5 or later. 2. For self-hosted instances: Download latest version from GitHub releases. 3. Replace existing installation with patched version. 4. Restart the draw.io service or application.
🔧 Temporary Workarounds
Network Egress Filtering
linuxRestrict outbound network connections from draw.io servers to only necessary destinations
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
Input Validation
allImplement strict validation of diagram files before processing
🧯 If You Can't Patch
- Isolate draw.io servers in a restricted network segment with limited outbound access
- Implement strict file upload validation and only allow trusted diagram sources
🔍 How to Verify
Check if Vulnerable:
Check draw.io version. If version is below 18.0.5, the system is vulnerable.Check Version:
Check application settings or about dialog in draw.io interfaceVerify Fix Applied:
Verify draw.io version is 18.0.5 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from draw.io server
- Requests to internal IP addresses or unusual domains
Network Indicators:
- HTTP requests from draw.io server to unexpected internal endpoints
- Port scanning activity originating from draw.io server
SIEM Query:
source="drawio" AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16)