Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-21T17:17:39.367Z",
  "pubdate": "2026-09-21T17:17:39.367Z",
  "executiveSummary": "A critical security flaw exists in the OAuth callback handler of draw.io versions prior to 30.2.7, specifically affecting self-hosted Docker and WAR deployments. The vulnerability involves a failure to validate the state parameter, which is a mandatory security mechanism designed to prevent Cross-Site Request Forgery (CSRF) and ensure the integrity of the OAuth handshake.\nBy neglecting to compare the stateToken with the cookieToken when the environment is not Google App Engine (IS_GAE is false), the application becomes susceptible to identity injection attacks. An attacker can manipulate the authentication flow to bind a victim's draw.io session to an attacker-controlled cloud storage account. This results in a session integrity loss where the victim unknowingly operates within the context of the attacker's identity. While this does not grant the attacker access to the victim's private cloud files, it leads to significant misattribution of actions, potential data exfiltration into the attacker's storage, and disruption of session trust. The vulnerability affects multiple integrations including Google Drive, OneDrive, GitHub, GitLab, and Dropbox.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the OAuth callback handler within src/main/java/com/mxgraph/online/AbsAuth.java. During the OAuth 2.0 authorization code grant flow, the state parameter is intended to be a cryptographically strong, unique, and non-predictable token generated by the client and sent to the authorization server. Upon the callback, the client must verify that the state parameter returned by the server matches the one initially sent in the cookie or session storage.\nIn the affected versions of draw.io, the logic explicitly skips this validation check if the IS_GAE (Google App Engine) flag is set to false. This renders self-hosted installations (Docker and WAR) inherently insecure against state-manipulation attacks. When IS_GAE is false, the application fails to perform a comparison between the stateToken and the cookieToken, effectively disabling the state-binding security control.\nThe attack flow proceeds as follows: 1) The attacker initiates an OAuth flow with a target cloud provider (e.g., GitHub, Google Drive) using their own identity and obtains a valid authorization code. 2) The attacker constructs a malicious callback URL containing this authorization code. 3) The attacker induces a victim, who is currently using a self-hosted draw.io instance, to interact with the crafted callback URL. 4) Because the application fails to validate the state token, it accepts the attacker's authorization code as the legitimate response to the victim's session request. 5) The victim's draw.io session is subsequently authenticated using the attacker's cloud identity. 6) The victim, operating under the assumption they are logged into their own account, performs cloud operations that are erroneously attributed to the attacker's account.\nThis vulnerability effectively bypasses the binding of the OAuth response to the original request initiated by the victim. The post-exploitation impact is primarily centered on session integrity loss and misattribution. An attacker can force a user to save diagram data to an attacker-controlled repository or cloud storage, potentially leading to unauthorized data capture. The vulnerability does not provide the attacker with direct access to the victim's existing cloud data, as the victim's session is effectively bound to the attacker's account, not vice versa. The flaw is present in all deployments where the environment configuration results in IS_GAE being false."
}