Executive brief
draw.io is a diagramming and whiteboarding application used for creating flowcharts and diagrams. When deployed with the proxy feature enabled (ENABLE_DRAWIO_PROXY=1), an attacker can exploit a time-of-check-time-of-use flaw in DNS resolution to bypass security checks and access internal cloud metadata services or corporate HTTP services, potentially exposing sensitive credentials and system information. The vulnerability affects all versions prior to 30.2.7.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the proxy servlet due to two separate DNS resolutions performed during URL validation and connection opening. The sanitizeUrl() method in Utils.java validates that a hostname does not resolve to private addresses, but ProxyServlet.java performs a second DNS resolution when actually opening the connection. An attacker can use DNS timing techniques to resolve an attacker-controlled hostname to a public address during validation, then to a private, link-local, or cloud metadata address during connection, bypassing the security check. This requires the ENABLE_DRAWIO_PROXY configuration flag to be enabled.
Affected products
- jgraph draw.io before 30.2.7
Timeline
- 2026-09-21: disclosed
- 2026-06-30: patched