CVE-2022-1711 PoC — JGraph draw.io 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1711.yaml

Associated Vulnerability

Title:JGraph draw.io 代码问题漏洞 (CVE-2022-1711)
Description:JGraph draw.io是JGraph的一个可配置的图表/白板可视化应用程序。 JGraph draw.io 18.0.6之前版本存在安全漏洞，该漏洞源于 draw.io 存在服务器端请求伪造 (SSRF)漏洞。

Description

Server-Side Request Forgery (SSRF) vulnerability in draw.io (also known as diagrams.net) prior to version 18.0.5 allows attackers to bypass URL validation restrictions in the ProxyServlet component. The vulnerability exists because the application does not properly validate URLs passed to its proxy endpoint, allowing attackers to make requests to internal services or external servers. This can lead to unauthorized access to internal resources and potential data exfiltration.

File Snapshot


 id: CVE-2022-1711

info:
  name: draw.io < 18.0.5 - Server Side Request Forgery (SSRF)
  author: rit

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!