An unauthenticated server-side request forgery vulnerability in jgraph drawio allows remote attackers to access sensitive cloud metadata or internal services.

This vulnerability is a TOCTOU race condition occurring between the URL validation logic in Utils.java and the actual request execution in ProxyServlet.java, permitting an attacker to bypass private address restrictions. The attacker can manipulate DNS resolution to access internal resources that are otherwise restricted from the proxy.

Successful exploitation allows an attacker to interact with internal network resources or extract sensitive cloud instance metadata, which may contain credentials or configuration details. Given the CVSS score of 6.8, this medium-severity flaw poses a significant risk to organizations hosting drawio in cloud environments, as it can facilitate lateral movement or unauthorized data access within the internal infrastructure.

Immediate Action: Upgrade jgraph drawio to version 30.2.7 or higher immediately to resolve the race condition in the proxy logic.

Proactive Monitoring: Review web server and proxy access logs for requests targeting internal IP addresses, loopback addresses, or cloud-specific metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: If patching is not immediately feasible, disable the drawio proxy feature by setting ENABLE_DRAWIO_PROXY=0 in the application configuration.

Public Exploit Available: Unknown

Organizations utilizing drawio with the proxy feature enabled must prioritize this update, as the flaw provides a direct path to sensitive internal information. Administrators should verify their current deployment version and apply the patch to version 30.2.7 to eliminate the TOCTOU vulnerability and secure the proxy service against unauthorized internal access.