Collected research

draw.io CVEs

@caioluders · lude.rs

Two draw.io flaws found by source review: the /proxy endpoint's blocklist of private hosts is defeated by http://0:8080/, giving SSRF; and an isAbsolute check returns false when URI parsing throws, so the malformed https:// @evil.com (note the space) passes as a relative path while Chrome still follows it, forwarding the victim's GitHub OAuth token to the attacker.

Record

Researcher

@caioluders

Published by

lude.rs

Topic

Other

In the archive

• Collected in the 2023 research round

Tags

• ssrf
• open-redirect
• oauth
• parser-differential
• url-parsing
• filter-bypass
• info-leak
• java
• cve
• owasp-a04-2021
• owasp-a05-2021
• owasp-a07-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of @caioluders, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.