draw.io versions before 30.2.7 have a CSRF vulnerability in the OAuth callback handler located in src/main/java/com/mxgraph/online/AbsAuth.java. When IS_GAE is false (self-hosted Docker and WAR deployments), the handler skips comparing the stateToken and cookieToken, which normally prevent CSRF attacks. An attacker can supply an authorization code for their own cloud-storage identity and trick a victim into visiting a crafted callback URL. This causes the victim’s draw.io session to be authenticated as the attacker’s identity without a valid state binding. The vulnerability affects multiple cloud-storage integrations including Google Drive, OneDrive, GitHub, GitLab, and Dropbox. While the attacker’s identity is bound to the victim’s session, it does not grant access to the victim’s existing cloud files. The flaw is resolved in draw.io version 30.2.7.

The vulnerability allows an attacker to cause a victim’s draw.io session to be authenticated as the attacker’s cloud-storage identity, resulting in session integrity loss and misattribution of cloud-storage actions. However, the attacker does not gain access to the victim’s existing cloud files. This can lead to unauthorized actions being performed under the attacker’s identity within the victim’s session context.

Upgrade draw.io to version 30.2.7 or later, where this vulnerability is fixed. The fix ensures proper validation of stateToken and cookieToken in the OAuth callback handler to prevent CSRF attacks. No other mitigation is indicated by the vendor advisory.