#application security

Draw.io Export Proxy Servlet Flaw Allows Path Traversal to Internal Backend Services

A path traversal vulnerability was uncovered in draw.io's export proxy servlet component, enabling attackers to query unintended internal endpoints on the backend export server. The root cause resides within `ExportProxyServlet.java` across lines 49 through 58, where the application extracts the trailing request path using `request.getPathInfo()`. The servlet splits the path on `/` separators and reconstructs a `proxyPath` variable without sanitizing traversal sequences. This unvalidated string is concatenated directly onto the base `EXPORT_URL` configuration to form the target URL via `new URL(exportUrl + proxyPath + queryString)` at line 85. Because Java's standard `URL` class does not perform path normalization, directory traversal payloads containing `..` escape the intended export path when resolved by the backend. Furthermore, the servlet forwards all original HTTP request headers and payloads directly to the internal destination without filtering. In typical containerized environments, the export server resides on the same internal Docker network as the draw.io application. Internal communication between these backend services lacks an authentication layer, meaning any reachable endpoint inherits implicit trust. An external actor can send a crafted request such as `GET /service/0/../../admin/config` to reach privileged internal routes like administrative interfaces or debug configurations. The recommended mitigation involves validating that path segments do not contain `..` or `%2e%2e`, normalizing the final target using `URI.normalize()`, and verifying that the final URI strictly matches the expected `EXPORT_URL` prefix.