CVE-2022-1722 SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio
An attacker can exploit an SSRF vulnerability in the editor's proxy to access internal IPv6 link-local addresses, potentially exposing sensitive internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1722?
CVE-2022-1722 is a high-severity server-side request forgery vulnerability in jgraph/drawio, published on 16 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses
Weakness: CWE-918
Which versions are affected by CVE-2022-1722?
It affects 1 product.
Products include Diagrams Drawio.
How do I fix CVE-2022-1722?
No fix has been published for CVE-2022-1722 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-1722 being exploited?
There is no known exploitation of CVE-2022-1722 in the wild and no public exploit code.
Other vulnerabilities in jgraph/drawio
- CVE-2023-3973 Cross-site Scripting (XSS) - Reflected in jgraph/drawio
- CVE-2023-3974 OS Command Injection in jgraph/drawio
- CVE-2022-2014 Code Injection in jgraph/drawio
- CVE-2022-1575 Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio
- CVE-2023-3975 OS Command Injection in jgraph/drawio
Sources
Also known as GHSA-q7gx-m2g7-jwx9.