Description

This vulnerability occurs because the desired domain value can be inserted into the A tag through deskDomain manipulation.

    if (window.location.hash != null && window.location.hash.substring(0, 9) == '#_TICKETS')
    {
        try
        {
            var temp = JSON.parse(decodeURIComponent(
                window.location.hash.substring(9)));
            
            if (temp != null && temp.ticketsConfig != null)
            {
                config = temp.ticketsConfig;
                configure();
                ui.fileLoaded(new LocalFile(ui, ui.emptyDiagramXml, this.defaultFilename, true));
                ui.editor.setStatus('Drag tickets from <a href="' + mxUtils.htmlEntities(deskDomain) +
                    '/a/tickets/filters/all_tickets" target="_blank">' +
                    mxUtils.htmlEntities(deskDomain) + '</a>');
            }
        }
        catch (e)
        {
            console.error(e);
        }
    }

The code above can set the config using the anchor value.

    function configure()
    {
        deskDomain = 'https://' + config.deskDomain + '.freshdesk.com';
        deskApiKey = config.deskApiKey;
        
        deskTypes = config.deskTypes || deskTypes;
        deskStatus = config.deskStatus || deskStatus;
        deskStatusWidth = {};

        // Precomputes text widths for custom ticket status
        var div = document.createElement('div');
        div.style.fontFamily = 'Arial,Helvetica';
        div.style.visibility = 'hidden';
        div.style.position = 'absolute';
        div.style.fontSize = '11px';
        
        document.body.appendChild(div);
        
        for (var key in deskStatus)
        {
            div.innerText = '';
            mxUtils.write(div, deskStatus[key]);
            deskStatusWidth[key] = div.clientWidth + 4;
        }

        document.body.removeChild(div);
    };

Creates a URL based on the deskDomain value of the configuration value passed from the configure() function. Afterwards, the value of the deskDomain created in this way is inserted as the value of the href attribute of the a tag and added to the DOM.

Proof of Concept

1. https://app.diagrams.net/?ui=min&p=tickets#_TICKETS{"ticketsConfig":{"deskApiKey":"google.com/","deskDomain":"google.com/"}}
2. And click the button: `Drag tickets From`

Impact

Open redirection attacks are most commonly used to support phishing attacks, or redirect users to malicious websites.