An unauthenticated server-side request forgery vulnerability in jgraph drawio permits unauthorized access to internal IPv6 network resources and cloud metadata services.

This is a server-side request forgery (SSRF) flaw (CWE-918) caused by improper validation of IPv6 Unique Local Addresses in the Utils.sanitizeUrl function. An unauthenticated attacker can exploit the /embed2.js endpoint to force the server to fetch and reflect responses from internal IPv6-reachable services.

The ability to perform SSRF against internal infrastructure poses a significant risk to organizational security. An attacker may exploit this vulnerability to exfiltrate cloud instance metadata, such as IAM credentials, or probe internal services that are not exposed to the public internet. Given the CVSS score of 7.7, this is a high-severity issue that could lead to full compromise of cloud environments or sensitive internal data exposure.

Immediate Action: Upgrade to drawio version 30.3.8 or later immediately to incorporate the corrected address validation logic.

Proactive Monitoring: Review web server and application access logs for anomalous requests to the /embed2.js endpoint, specifically looking for attempts to access internal IPv6 addresses or unusual query parameters.

Compensating Controls: Implement strict egress filtering on the host running drawio to block outbound connections to internal network segments and sensitive cloud metadata service endpoints.

Public Exploit Available: Unknown

This vulnerability presents a clear path to internal network reconnaissance and data theft. Security teams should prioritize the update to version 30.3.8 across all instances of drawio. If immediate patching is not feasible, ensure that network-level egress controls are configured to prevent the application from reaching internal resources or cloud metadata services.