CVE-2026-63334

Executive Summary

CVE-2026-63334 is a server-side request forgery (SSRF) vulnerability in draw.io (diagrams.net) deployments configured with ENABLE_DRAWIO_PROXY=1, affecting versions prior to 30.2.7. The flaw arises from a time-of-check-to-time-of-use (TOCTOU) weakness (CWE-367) in which the private-address validation performed by Utils.sanitizeUrl() uses one DNS resolution while the subsequent connection in ProxyServlet performs a second, independent resolution. An attacker who controls a hostname with a DNS record that changes between these two resolutions can bypass the private-address blocklist and force the draw.io proxy to connect to internal, link-local, or cloud metadata endpoints, exposing sensitive metadata and internal HTTP services. The vulnerability is remotely exploitable with no authentication or user interaction, though exploitation requires attacker control of a DNS-resolvable hostname and the ability to win the resolution race, reflected in the assigned CVSS score of 6.8.

Technical Analysis

The vulnerability is a classic DNS-rebinding-adjacent TOCTOU defect in the draw.io server-side proxy functionality. When draw.io is deployed with the environment variable ENABLE_DRAWIO_PROXY=1, the application exposes a proxy servlet that fetches remote resources on behalf of the client — a common requirement for diagram rendering that needs to pull remote images or referenced content.

The security control intended to prevent abuse of this proxy is implemented in src/main/java/com/mxgraph/online/Utils.java, specifically in the method Utils.sanitizeUrl(). This method performs a private-address check: it resolves the supplied hostname to an IP address and validates whether that address falls within a private, link-local, or otherwise restricted range. If the check passes (i.e., the resolved address appears public), the request is allowed to proceed.

The problem is that validation and connection are performed at two different points in time, each with its own DNS resolution:

1. Check phase: Utils.sanitizeUrl() in Utils.java performs a DNS resolution and evaluates the resulting IP address against the private-address rules.
2. Use phase: src/main/java/com/mxgraph/online/ProxyServlet.java subsequently calls URL.openConnection(), which performs a second, independent DNS resolution before establishing the outbound TCP connection.

Because DNS is not pinned between these two operations, the name can legitimately resolve to different addresses on each lookup. An attacker who controls an authoritative DNS server for the supplied hostname can return a public IP address during the validation lookup and then return a private, link-local, or cloud metadata address during the connection lookup.

This is a textbook TOCTOU race (CWE-367), and it also overlaps conceptually with DNS rebinding techniques. The core defect is architectural: the code validates an IP it never actually connects to. A robust implementation would resolve once, validate that exact IP, and then connect to the pinned IP address rather than re-resolving the hostname.

The attack surface is the HTTP-facing proxy endpoint exposed when ENABLE_DRAWIO_PROXY=1. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates network reachability, high attack complexity (the DNS-timing race), no privileges or user interaction required, a scope change (the vulnerable component can affect resources beyond its security authority — here, internal services and cloud metadata), and high confidentiality impact with no integrity or availability impact. The absence of integrity and availability impact is consistent with the proxy acting as a read/relay channel that returns responses to the attacker rather than modifying target systems.

It is important to note the version boundary: the issue is described as fixed in version 30.2.7. No public proof-of-concept, Nuclei template, or exploit code was available at the time of this report, and FIRST.org had not yet assigned an EPSS score. The vendor/product metadata has not been authoritatively confirmed by NVD, and no OSV package or affected-version list has been published through those channels; the only version constraint available is the description's statement that prior to 30.2.7 the proxy is vulnerable.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (SSRF via DNS-resolution TOCTOU) and the mechanisms explicitly described.

1) Reconnaissance / target identification. The attacker identifies a draw.io deployment with the server-side proxy enabled (ENABLE_DRAWIO_PROXY=1). Such instances are typically self-hosted draw.io/Diagrams.net servers reachable over the network and configured to fetch remote diagram resources. The attacker lures or directs a proxy request to a hostname under their control.

2) Triggering the flaw class. The attacker supplies a URL whose hostname is controlled by the attacker's authoritative DNS server. During the validation step, Utils.sanitizeUrl() resolves the hostname and receives a public IP address, passing the private-address check. The request is then permitted to proceed.

3) Payload/execution at the vulnerability-class level. When ProxyServlet calls URL.openConnection(), a second DNS resolution occurs. The attacker's DNS server, responding to the connection-time lookup (typically after a low TTL or on a subsequent query), returns a private, link-local, or cloud metadata address instead. The proxy connects to that internal address, even though the address was never validated. The attacker supplies the target internal IP/hostname via the DNS response rather than directly in the request, which is why the private-address filter is bypassed.

4) Post-exploitation impact. The proxy returns the internal HTTP response to the attacker through the proxy channel. Per the NVD description, successful exploitation can return cloud instance metadata (for example, credentials or instance identity material exposed by a cloud metadata service) or responses from internal HTTP services. Because CVSS indicates high confidentiality impact with no integrity or availability impact, the primary outcome is information disclosure and internal network reconnaissance. No public evidence of exploitation in the wild exists, and the CVE is not listed in CISA KEV.

Impact Assessment

• Confidentiality (High): The primary impact is disclosure of sensitive data reachable from the draw.io server — cloud instance metadata and internal HTTP service responses. Cloud metadata frequently includes temporary credentials or instance identity, which can enable further lateral movement or cloud API access.
• Integrity (None) / Availability (None): Per the CVSS vector, the proxy is used as a read/relay channel; the vulnerability does not inherently permit modification of internal services or denial of service.
• Scope (Changed): The vulnerable draw.io component can impact resources beyond its own security boundary — internal network services and cloud metadata endpoints that are not intended to be reachable by external users.
• Attack complexity (High): Exploitation depends on controlling DNS for the supplied hostname and successfully winning the check-to-use race, which reduces likelihood but does not eliminate risk for internet-exposed proxies.
• Blast radius: Any draw.io instance with ENABLE_DRAWIO_PROXY=1 and network reachability to internal or cloud metadata services. Deployments that expose the server-side proxy to untrusted users or the internet, and that run in cloud environments with reachable metadata endpoints, are at the greatest risk. Because the CVE is unpatched in tracked sources (0/4 patch confidence), all pre-30.2.7 deployments must be treated as affected until upgraded.

Detection Guidance

Sigma Rule

title: Potential draw.io SSRF via DNS TOCTOU (CVE-2026-63334)
id: 6e9b2c1a-8f4d-4a3e-9c1b-2d7e5f0a1b23
status: experimental
description: Detects draw.io proxy activity with hostnames that may resolve to internal or metadata addresses, consistent with CVE-2026-63334 SSRF exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63334
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - 'url='
      - 'proxy'
  selection_target:
    cs-uri-query|contains:
      - '169.254.169.254'
      - 'metadata.google.internal'
      - 'metadata.azure'
      - 'localhost'
      - '127.0.0.1'
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection_path and selection_target
falsepositives:
  - Legitimate administrative access to internal resources
level: high

YARA Rule

rule CVE_2026_63334_drawio_ssrf_toctou
{
    meta:
        description = "Detects draw.io proxy source indicators and internal/metadata SSRF targets related to CVE-2026-63334"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63334"
        date = "2026-01-01"
    strings:
        $cls1 = "Utils.sanitizeUrl" ascii
        $cls2 = "ProxyServlet" ascii
        $cls3 = "ENABLE_DRAWIO_PROXY" ascii
        $md1  = "169.254.169.254" ascii
        $md2  = "metadata.google.internal" ascii
        $path = "mxgraph/online" ascii
    condition:
        (any of ($cls1, $cls2, $cls3, $path)) and (any of ($md1, $md2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-63334 draw.io SSRF attempt - internal/metadata target in proxy parameter"; flow:to_server,established; http.uri; content:"url="; nocase; pcre:"/url=[^&]*(169\.254\.169\.254|metadata\.google\.internal|metadata\.azure|127\.0\.0\.1|10\.\d|192\.168\.)/i"; reference:cve,2026-63334; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-63334; classtype:attempted-recon; sid:202663334; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [http where http.request.method == "GET" and wildcard(http.request.uri, "*url=*")]
  [dns where dns.question.name != null]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=drawio
| search uri=*url=* 
| rex field=uri "url=(?<target>[^&]+)"
| where match(target, "(169\.254\.169\.254|metadata\.google\.internal|metadata\.azure|127\.0\.0\.1|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.)")
| table _time, clientip, uri, target, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,drawio,ssrf,">
  <rule id="2026633" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>url=</match>
    <regex>169\.254\.169\.254|metadata\.google\.internal|metadata\.azure|127\.0\.0\.1</regex>
    <description>CVE-2026-63334: draw.io proxy SSRF attempt targeting internal or cloud metadata address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,cve_2026_63334,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable the server-side proxy by removing or unsetting ENABLE_DRAWIO_PROXY=1 where it is not strictly required.
   • Restrict network egress from draw.io hosts so they cannot reach cloud metadata endpoints or internal HTTP services (deny access to 169.254.169.254, link-local ranges, and internal subnets at the firewall or cloud security-group/proxy layer).
   • Enforce IMDSv2 (session-token-required) on cloud instances to reduce the value of metadata disclosure.
   • Place the proxy behind authentication so only trusted users can supply proxy URLs.
   • Apply DNS-based egress controls and monitor for rapidly changing DNS responses to attacker-controlled domains.

2. Patch/upgrade steps

   • Upgrade draw.io to version 30.2.7 or later, which the NVD description states fixes this issue.
   • After upgrading, re-verify that the proxy enforces a single validated DNS resolution (or IP pinning) between validation and connection.
   • Since tracked patch sources indicate UNPATCHED status with no advisory references, confirm against the upstream draw.io release notes for 30.2.7 before relying solely on this report.

3. Long-term hardening

   • Adopt a proxy architecture that resolves a hostname once, validates the exact resulting IP, and connects to that pinned IP (preventing TOCTOU re-resolution).
   • Maintain a strict allowlist for proxy destinations rather than a denylist of private ranges.
   • Segment draw.io deployments from sensitive internal networks and cloud control planes.
   • Add continuous monitoring for SSRF patterns and unusual outbound connections from the draw.io host.

References

• NVD — CVE-2026-63334: https://nvd.nist.gov/vuln/detail/CVE-2026-63334
• draw.io / diagrams.net official site and release notes (version 30.2.7 fix): https://www.drawio.com/
• CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (CVE-2026-63334 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation was available at the time of this report. No threat actor campaigns have been attributed to this CVE. FIRST.org had not assigned an EPSS score.