CVE-2026-63334: draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLEDRAWIOPROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.ioto a version that resolves this vulnerability.Fixed in 30.2.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments that set ENABLE_DRAWIO_PROXY=1 are affected before version 30.2.7. The issue is in the proxy path, where hostname validation and the outbound connection use separate DNS resolutions.
What does an attacker need to exploit this?
An attacker needs to control a hostname whose DNS responses can change between the proxy's validation lookup and its connection lookup. They can make it resolve publicly during validation and then resolve to a private, link-local, or cloud metadata address for the outbound request.
What can an attacker access through successful exploitation?
Successful exploitation can return responses from internal HTTP services or cloud instance metadata through the proxy. The reported impact is disclosure of confidential information.
What should be done if upgrading is not immediately possible?
Disable the draw.io proxy by ensuring ENABLE_DRAWIO_PROXY is not set to 1. This removes the affected proxy functionality described in the advisory.