PT-2022-3218 · Drawio · Drawio

Published 2022-05-18 · Updated 2022-06-07 · CVE-2022-1784

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions drawio versions prior to 18.0.8

Description The issue is related to insufficient validation of incoming requests in the url.openConnection() function of the Embed2 servlet in the drawio diagram-building software. This can be exploited by a remote attacker to perform a Server-Side Request Forgery (SSRF) attack by sending a specially crafted HTTP request.

Recommendations For versions prior to 18.0.8, update to version 18.0.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the url.openConnection() function to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2022-03918

CVE-2022-1784

Affected Products

Drawio

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1784.json · Exploit
• 🔥 https://huntr.dev/bounties/d1330ce8-cccb-4bae-b9a9-a03b97f444a5 · Exploit
• https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1784 · Security Note
• https://bdu.fstec.ru/vul/2022-03918 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1784 · Vendor Advisory
• https://vuldb.com/?id.200470 · Note
• https://cybersecurity-help.cz/vdb/SB2022052412 · Note