CVE-2022-1767
📋 TL;DR
This Server-Side Request Forgery (SSRF) vulnerability in draw.io allows attackers to make unauthorized requests from the server to internal systems. It affects users running draw.io versions prior to 18.0.7, potentially exposing internal network resources to external attackers.
💻 Affected Systems
- draw.io diagramming software
📦 What is this software?
Drawio by Diagrams
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data from internal systems, or perform attacks against internal infrastructure using the server as a proxy.
Likely Case
Information disclosure from internal services, scanning of internal networks, or accessing metadata services in cloud environments.
If Mitigated
Limited impact with proper network segmentation and egress filtering, though some information disclosure may still occur.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and public details exist in the bounty report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.0.7
Vendor Advisory: https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf
Restart Required: Yes
Instructions:
1. Update draw.io to version 18.0.7 or later. 2. Restart the draw.io service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Network egress filtering
allRestrict outbound connections from the draw.io server to only necessary external services
Reverse proxy restrictions
allConfigure reverse proxy to block requests to internal IP ranges and sensitive URLs
🧯 If You Can't Patch
- Implement strict network segmentation to isolate draw.io server from sensitive internal systems
- Deploy web application firewall (WAF) rules to detect and block SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check draw.io version - if below 18.0.7, the system is vulnerableCheck Version:
Check application version in UI or configuration filesVerify Fix Applied:
Confirm version is 18.0.7 or higher and test SSRF functionality is blocked📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from draw.io server
- Requests to internal IP addresses or metadata services
Network Indicators:
- Unexpected traffic from draw.io server to internal services
- Requests to cloud metadata endpoints
SIEM Query:
source="drawio" AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16 OR dest_ip=169.254.169.254)