CVE-2026-63334: draw.io SSRF Vulnerability in Proxy

CVE-2026-63334 Overview

CVE-2026-63334 is a server-side request forgery (SSRF) vulnerability in draw.io, a configurable diagramming and whiteboarding application. The flaw affects deployments configured with ENABLE_DRAWIO_PROXY=1 and stems from a time-of-check to time-of-use (TOCTOU) race condition [CWE-367] between DNS resolutions. An attacker-controlled hostname can pass the private-address validation check and then resolve to an internal address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. The issue is fixed in draw.io version 30.2.7.

Critical Impact
Attackers can bypass SSRF protections to reach cloud metadata endpoints and internal HTTP services through a vulnerable draw.io proxy.

Affected Products

draw.io (jgraph/drawio) prior to version 30.2.7
Deployments configured with ENABLE_DRAWIO_PROXY=1
Self-hosted draw.io server instances exposing the proxy servlet

Discovery Timeline

2026-09-21 - CVE-2026-63334 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63334

Vulnerability Analysis

The vulnerability is a classic DNS rebinding attack enabled by inconsistent DNS resolution across two code paths. In src/main/java/com/mxgraph/online/Utils.java, the Utils.sanitizeUrl() method performs a private-address check using a single DNS resolution to confirm the target hostname is public. Later, src/main/java/com/mxgraph/online/ProxyServlet.java invokes URL.openConnection(), which triggers a second DNS resolution. Between these two lookups, an attacker-controlled authoritative DNS server can return a public address for the first query and a private, link-local, or cloud metadata address for the second. This allows the proxy to fetch content from internal-only endpoints and return the response to the attacker.

Root Cause

The root cause is a time-of-check to time-of-use flaw [CWE-367]. The validation logic assumes DNS results remain stable across two separate resolutions, but the underlying resolver is not cached or pinned between the check and the network operation. This design allows the resolved IP address used for connection to differ from the address that was validated.

Attack Vector

An unauthenticated remote attacker hosts a domain backed by a controlled DNS server with a very low TTL. The attacker submits a proxy request to the draw.io server referencing that domain. During validation, the DNS server returns a public IP address, satisfying Utils.sanitizeUrl(). When ProxyServlet opens the connection, the DNS server responds with an internal address such as 169.254.169.254 (AWS/GCP metadata) or an internal RFC1918 range. The proxy fetches the internal resource and returns it in the HTTP response.

text

// Patch reference: draw.io VERSION bump to 30.2.7
-30.2.6
+30.2.7

Source: GitHub Commit 650fbd7

Detection Methods for CVE-2026-63334

Indicators of Compromise

Outbound proxy requests from draw.io to cloud metadata endpoints such as 169.254.169.254, metadata.google.internal, or 100.100.100.200.
Repeated proxy requests to the same attacker-controlled hostname with unusually low DNS TTL values.
Unexpected internal HTTP traffic originating from the draw.io server process to RFC1918 or link-local address ranges.

Detection Strategies

Inspect access logs for ProxyServlet requests that reference external domains resolving to varying IP addresses within short time windows.
Compare DNS resolution results observed by the application host against IP addresses recorded in egress firewall logs for the same hostnames.
Alert on any HTTP requests from draw.io application servers destined for cloud metadata IPs or internal service ranges.

Monitoring Recommendations

Enable egress network monitoring on hosts running draw.io with ENABLE_DRAWIO_PROXY=1.
Capture DNS query logs from the draw.io host and correlate with outbound connections to detect rebinding patterns.
Monitor cloud audit logs (AWS IMDS, GCP metadata, Azure IMDS) for calls originating from the draw.io instance.

How to Mitigate CVE-2026-63334

Immediate Actions Required

Upgrade draw.io to version 30.2.7 or later, which contains the fix in commit 650fbd7.
If upgrading is not immediately possible, set ENABLE_DRAWIO_PROXY=0 to disable the vulnerable proxy servlet.
Restrict egress traffic from the draw.io host to cloud metadata endpoints and internal-only IP ranges at the network layer.

Patch Information

The vendor released draw.io version 30.2.7 to remediate CVE-2026-63334. See the GitHub Release v30.2.7 and the GitHub Security Advisory GHSA-3v4h-8r2c-m8c5 for full details.

Workarounds

Disable the draw.io proxy feature by setting the environment variable ENABLE_DRAWIO_PROXY=0.
Enforce IMDSv2 on AWS instances hosting draw.io to require session tokens for metadata access.
Block outbound requests from the draw.io server to 169.254.0.0/16, 127.0.0.0/8, and RFC1918 ranges using host or network firewalls.
Place the draw.io proxy behind an egress proxy that re-validates destination IPs after DNS resolution.

bash

# Disable the vulnerable proxy servlet
export ENABLE_DRAWIO_PROXY=0

# Example iptables rules to block metadata and internal ranges from the draw.io host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP