draw.io versions before 30.3.8 contain an SSRF vulnerability (CWE-918) due to improper validation of IPv6 Unique Local Addresses in the Utils.sanitizeUrl() method. The application checks for IPv6 ULA prefixes 'fc00::' and 'fd00::' as text prefixes, but the Java JDK returns expanded IPv6 addresses, causing the check to fail. This allows unauthenticated requests to the /embed2.js?fetch= endpoint to cause the server to fetch internal IPv6 ULA resources, including AWS metadata service ranges, and reflect the response back to the requester. The ProxyServlet path has similar issues but requires a proxy feature flag. The vulnerability enables disclosure of cloud metadata credentials or other internal service data reachable via IPv6. The vulnerability is addressed in draw.io version 30.3.8.

An unauthenticated attacker can exploit this SSRF vulnerability to access internal IPv6-only resources, including cloud metadata services such as AWS metadata endpoints. This can lead to disclosure of sensitive information like cloud credentials or internal service data. The vulnerability has a high severity score (CVSS 7.7) and does not require user interaction or privileges.

A patch is available and the vulnerability is fixed in draw.io version 30.3.8. Users and administrators should upgrade to version 30.3.8 or later to remediate this issue. Since this is a cloud-hosted service, the vendor manages remediation for the cloud environment; verify with the vendor advisory for hosted service patch status. No additional mitigation is required if the patch is applied.