SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio
May 13th 2022
The proxy server does not check for link-local IPv6 addresses
In https://github.com/jgraph/drawio/blob/dev/src/main/java/com/mxgraph/online/ProxyServlet.java#L255L257, it checks for local IP addresses. It is missing the link-local IPv6 address check -
Proof of Concept
1: Setup Wireshark 2: In your local copy of the DrawIO webapp open:
3: The server, takes a while as it attempts to connect to [fe80::1], the default gateway (seen from Wireshark logs) - denoting that fe80:: link-local IPv6 addresses are not being filtered.
SSRF to internal link-local IPv6 addresses