CVE-2026-72777

Executive Summary

CVE-2026-72777 is a server-side request forgery (SSRF) vulnerability affecting Next AI Draw.io through version 0.4.16. The flaw resides in the POST /api/parse-url endpoint, where hostname validation relies solely on string pattern matching without performing DNS resolution, allowing unauthenticated remote attackers to submit hostnames that bypass string validation yet resolve to internal network addresses. Successful exploitation enables attackers to reach arbitrary internal HTTP services and exfiltrate their responses, including cloud metadata credentials (e.g., AWS IMDS, Azure IMDS, or GCP metadata endpoints). The vulnerability carries a CVSS base score of 8.6 (High severity) due to its network exploitability, no authentication requirement, and high confidentiality impact with a scope change. At the time of this report, no patch is available, no CISA KEV listing exists, and no public exploit code has been identified.

Technical Analysis

The vulnerability is a classic SSRF (CWE-918) arising from insufficient validation logic in the URL-parsing functionality of Next AI Draw.io. The affected endpoint, POST /api/parse-url, accepts a URL provided by an unauthenticated user and presumably fetches that URL to parse content — a common feature in diagram tools that import URLs or fetch remote resources for rendering.

The root cause is described as hostname validation that "only checks string patterns without DNS resolution." This indicates the application's security control operates on the literal string representation of the hostname rather than the IP address to which that hostname actually resolves. Attackers can exploit this by supplying hostnames that:

1. Obfuscate internal IP addresses — e.g., using decimal, hex, or octal representations of IP addresses (e.g., 2130706433 for 127.0.0.1, or 0x7f000001), which may bypass string-based blocklists.
2. Use alternative DNS names — e.g., localtest.me, spoofed.burpcollaborator.net, or internal DNS names that resolve to RFC 1918 or loopback addresses.
3. Employ redirect-based chaining — the initial URL passes validation (e.g., points to an external domain), but the destination server issues a 302 redirect to an internal IP, and the server-side fetch follows the redirect without re-validation.

Because the validation logic does not perform DNS resolution and compare the resulting IP against internal/private ranges, any hostname that resolves to an internal address (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254, 127.0.0.0/8, etc.) can be reached by the server-side fetch.

An important note on exploitation mechanics: because the CNA description does not provide source code or implementation details, the exact validation logic (e.g., regex patterns, blocklists, allowlists) is not disclosed. However, the vulnerability class (SSRF with inadequate hostname validation) is well-documented across numerous web applications. The server-side request engine presumably executes an HTTP client (e.g., Node.js http/https module, axios, or fetch) to retrieve the user-supplied URL and returns the response body (or a processed version) to the attacker, enabling response exfiltration.

The attack surface is the application's public-facing instance running the web server that exposes the /api/parse-url endpoint. Because the vulnerability requires no authentication, any unauthenticated attacker who can reach the server over the network can exploit it. The server-side fetch operates from the application's network context, which often includes access to internal services not otherwise reachable from the internet.

Exploitation Scenarios

Attack Chain (inferred from vulnerability class — no public PoC available):

Step 1: Reconnaissance / Target Identification The attacker discovers a public deployment of Next AI Draw.io. Shodan/Censys queries (e.g., for banner or title containing "Next AI Draw.io" or "draw.io") can identify exposed instances. The attacker may also probe common API paths by sending an unauthenticated POST request to /api/parse-url with a benign external URL to verify the endpoint exists and returns parsed content.

Step 2: Triggering the Flaw The attacker crafts a POST request to /api/parse-url with a URL containing a hostname that passes the string-pattern validation but resolves to an internal address. Examples: http://169.254.169.254/latest/meta-data/, http://localtest.me:8080/, or http://0xA9FEA9FE/ (hex representation of 169.254.169.254). Alternatively, the attacker may use an external redirector they control that sends a 302 to an internal IP.

Step 3: Payload / Execution Method The server-side fetch engine processes the URL and issues an HTTP request to the resolved internal address. The attack operates at the HTTP protocol level — no code execution is involved. The key insight is that the server performs the request from its own network position, meaning the target internal service sees a legitimate high-privilege client. If the internal service honors the request (e.g., an internal admin panel, a configuration management API, or cloud metadata service), the response is returned.

Step 4: Post-Exploitation Impact

• Cloud metadata exfiltration: If the hosting environment is a public cloud (AWS, Azure, GCP), the attacker can fetch http://169.254.169.254/latest/meta-data/ (AWS) or platform-equivalent endpoints and retrieve temporary credentials (instance identity documents, IAM role credentials), security group details, user data scripts, or API tokens.
• Internal service reconnaissance: The attacker can scan the internal network (e.g., http://10.0.0.1:8080/, http://192.168.1.1/ for router admin UIs) and enumerate internal services or access management interfaces with default credentials.
• Data exfiltration: Any internal HTTP service that transmits sensitive data (e.g., internal REST APIs, CI/CD systems, databases with HTTP interfaces) can be queried, and the responses are returned to the attacker.

The CVSS vector reflects this: Attack Vector = Network (exploitable remotely), Attack Complexity = Low (no special conditions), Privileges Required = None, User Interaction = None, Scope = Changed (the vulnerable component is the web application, but the impact crosses into the internal network — a different security boundary), Confidentiality = High (full internal HTTP service response disclosure), Integrity = None, Availability = None.

Impact Assessment

Business Impact: The SSRF vulnerability allows unauthenticated remote attackers to pivot from the publicly exposed application into the internal network. The most critical impact is the exfiltration of cloud metadata, which can yield IAM credentials. In AWS, these credentials often grant access to S3 buckets, EC2 instances, Lambda functions, and other cloud resources. In Azure, the managed identity token can be used to access Azure AD-protected resources. An attacker obtaining such credentials can achieve lateral movement, data theft, or resource hijacking. Even outside cloud environments, SSRF can enable access to internal web applications (admin panels, CMS, CI/CD servers) that may be behind network firewalls but have no application-layer authentication — leading to further compromise.

Affected Systems: All deployments of Next AI Draw.io versions through 0.4.16 that expose the POST /api/parse-url endpoint publicly or on any network where untrusted users can send requests. Instances are typically self-hosted web services.

Blast Radius: The confidentiality impact is High (C:H). The scope change (S:C) in the CVSS vector means the compromised component (the web application) is distinct from the impacted component (the internal network). This means the SSRF can be used to compromise resources that the application itself has no business accessing. If cloud metadata is retrieved and credentials are extracted, the blast radius extends to the entire cloud account/tenant depending on the IAM role's privileges.

CVSS Subscore Reference: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N — Base Score 8.6 (High). The High severity rating is justified given the trivial exploitability, no authentication barrier, and high confidentiality impact across network boundaries. Integrity and availability are unaffected directly, but credential theft can lead to downstream integrity/availability impacts.

Detection Guidance

Note: Because no public exploit code or implementation details are available, the detection guidance below focuses on generic SSRF detection patterns for the described endpoint. These rules aim to detect anomalous requests targeting internal addresses or metadata services via the described API, and should be tailored to the actual log formats and schema of your environment.

Sigma Rule

title: Next AI Draw.io SSRF - Internal Address Request to /api/parse-url
id: d2f4be2f-3f5c-4a3d-9f8b-1a2b3c4d5e6f
status: experimental
description: Detects POST requests to /api/parse-url with URLs resolving to internal IP ranges or cloud metadata endpoints, potentially indicating SSRF exploitation (CVE-2026-72777).
author: Valters IT Threat Intelligence
date: 2026/05/15
tags:
    - attack.t1190
    - attack.t1090
    - cve.2026.72777
logsource:
    category: webserver
    product: generic
    definition: 'Web server access logs or reverse proxy logs (nginx, apache, haproxy)'
detection:
    selection_endpoint:
        cs-method: 'POST'
        cs-uri-path: '/api/parse-url'
    selection_ssrf_patterns:
        cs-uri-query|contains:
            - '169.254.169.254'       # cloud metadata (AWS/Azure/GCP)
            - '127.0.0.1'
            - 'localhost'
            - '0.0.0.0'
            - 'localtest.me'
            - 'spoofed'
            - '%2Flatest%2Fmeta-data'  # URL-encoded AWS metadata path
        cs-uri-query|re:
            - 'https?://(10|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\.[0-9]{1,3}\.[0-9]{1,3}'
    condition: selection_endpoint and selection_ssrf_patterns
    timeframe: 5m
falsepositives:
    - Legitimate feature usage where users intentionally parse internal URLs (should be rare and reviewed)
    - Monitoring tools checking reachability of internal endpoints via the API
level: high

YARA Rule

rule detect_next_ai_drawio_ssrf_request
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects network traffic or log entries containing URL POST requests to /api/parse-url with SSRF indicators"
        cve = "CVE-2026-72777"
        date = "2026-05-15"
        severity = "high"
    strings:
        $endpoint = "/api/parse-url" ascii
        $method = "POST" ascii
        $aws_metadata = "169.254.169.254" ascii
        $loopback1 = "127.0.0.1" ascii
        $loopback2 = "localhost" ascii
        $private10 = "10." ascii
        $private172 = "172." ascii
        $private192 = "192.168." ascii
        $aws_meta_path = "/latest/meta-data" ascii
    condition:
        $endpoint and $method and any of ($aws_metadata, $loopback1, $loopback2, $private10, $private172, $private192, $aws_meta_path)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Next AI Draw.io SSRF - Request to /api/parse-url with internal/cloud metadata address"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/parse-url"; http.uri; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|localhost|10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.[0-9]{1,3})/Ui"; classtype:attempted-recon; sid:202672777; rev:1; metadata:cve CVE-2026-72777, attack_target Web_Server, deployment Perimeter, tag ssrf;)

Elastic Detection

sequence by source.ip, user.name with maxspan = 5m
  [ network where
      network.direction == "ingress" and
      http.request.method == "POST" and
      url.path == "/api/parse-url" and
      url.query contains "http://" or url.query contains "https://"
  ]
  [ network where
      network.direction == "egress" and
      url.domain == "169.254.169.254" or
      ip == "169.254.169.254" or
      ip.starts_with("10.") or
      ip.starts_with("192.168.") or
      (ip.starts_with("172.") and ip in ["172.16.0.0/12"])
  ]

Splunk SPL Query

index=webproxy OR index=webserver
| WHERE method="POST" AND uri_path="/api/parse-url"
| rex field=uri_query "https?:\/\/(?<target_host>[^\/\?]+)"
| eval is_ssrf = if(
    match(target_host, "(?i)(169\.254\.169\.254|127\.0\.0\.1|localhost|10\.[0-9]+\.[0-9]+\.[0-9]+|192\.168\.[0-9]+\.[0-9]+|172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]+\.[0-9]+)"),
    1, 0)
| where is_ssrf=1
| stats count by src_ip, dest_host, target_host, _time
| sort - _time

Wazuh OSSEC Rule

<group name="ssrf,">
  <rule id="100277" level="15">
    <if_sid>31122, 31100</if_sid>
    <regex>(?i)\bPOST\b.*\b/api/parse-url\b.*\b(169\.254\.169\.254|127\.0\.0\.1|localhost|10\.[0-9]+\.[0-9]+\.[0-9]+|192\.168\.[0-9]+\.[0-9]+|172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]+\.[0-9]+)\b</regex>
    <description>Next AI Draw.io SSRF attempt: POST to /api/parse-url with internal address (CVE-2026-72777)</description>
    <group>ssrf,attack,t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED.

No patch evidence exists from any tracked source. No vendor fix, no official advisory, no upgraded version addressing this issue has been identified. The affected version range is reported as "through 0.4.16," implying that no version beyond 0.4.16 has yet been released with a fix.

1) Immediate Mitigations (until a patch is available):

• Disable or restrict the /api/parse-url endpoint: If the feature is not business-critical, disable the endpoint entirely through the application's configuration or via a reverse proxy (e.g., block POST requests to /api/parse-url at nginx/HAProxy level).
• Network-level egress filtering: Apply strict egress filtering at the application server's firewall so that outbound HTTP/HTTPS connections from the application are only permitted to the public internet (or to a specific allowlist of remote services). Explicitly block all private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), link-local (169.254.0.0/16), and metadata service IPs (169.254.169.254). This is the most effective immediate mitigation for SSRF.
• Authentication enforcement: If the application supports authentication configuration, require authentication for the /api/parse-url endpoint to at least reduce the attack surface to authenticated users.
• Reverse proxy ingress rules: If the application is exposed via nginx/Apache, add an ACL rule to block requests where the POST body's url parameter references internal IP ranges or metadata endpoints (though body inspection through a WAF is the more reliable path).

2) Patch/Upgrade Steps:

• Monitor the vendor's release channels (GitHub repository, official website, package registries) for a patched version higher than 0.4.16. When available, upgrade immediately and re-test the endpoint's URL validation behavior with internal addresses.
• As of the report date, no patch is available. Do not assume any unofficial workaround address this issue.

3) Long-Term Hardening:

• Deploy a Web Application Firewall (WAF) with SSRF-specific rule sets (e.g., rules that flag URLs containing private IP addresses, cloud metadata paths, or alternative IP encodings).
• Implement outbound proxy for the application server where only a curated allowlist of remote domains is permitted for URL-fetching features.
• Enforce strict network segmentation so that the application server has no unnecessary routes to internal services; route detection services should rely on the principle of least privilege.
• Enable and review logs for the application (especially around /api/parse-url) and network egress traffic, alerting on any connection to private or metadata IP ranges.

References

1. NVD Entry for CVE-2026-72777 — https://nvd.nist.gov/vuln/detail/CVE-2026-72777 (NVD Description and CVSS Score as cited above; no additional technical data provided at time of writing)
2. CWE-918 (Server-Side Request Forgery) Reference — https://cwe.mitre.org/data/definitions/918.html (vulnerability class description and typical remediation patterns)
3. Next AI Draw.io Project (vendor repository) — insufficient public information available to reference vendor advisory; no official advisory has been published
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-72777 is NOT listed; not known to be exploited in the wild as of report date)
5. CVSS Calculator (FIRST.org) — https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (for CVSS vector semantics reference)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No active exploitation campaigns have been publicly reported for CVE-2026-72777. The vulnerability is not listed in CISA KEV. No exploit code or PoC has been published. However, SSRF flaws in diagram/visualization tools are a known attack vector in the wild (e.g., similar issues in other tools), and given the low complexity and unauthenticated access, exploit attempts are likely once CVE details circulate in the security community. It is prudent to treat this vulnerability as actively targetable.

Report generated by Valters IT Threat Intelligence — 2026. Data current as of publication date. All technical claims are derived from the supplied CVE intelligence data; where specific implementation details are absent, descriptions are grounded in general SSRF vulnerability class mechanics.