Server-Side Request Forgery in Next AI Draw.io

Executive Summary

CVE-2026-72777 is a Server-Side Request Forgery (SSRF) vulnerability in Next AI Draw.io versions up to 0.4.16. It affects the POST /api/parse-url endpoint which fetches content from user-supplied URLs. The vulnerability occurs because hostname validation only checks string patterns without DNS resolution, allowing attackers to bypass restrictions using techniques like DNS rebinding.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for unusual outbound requests from the Next AI Draw.io server, particularly to internal IP addresses or unexpected domains. Check logs for POST requests to /api/parse-url with suspicious hostnames like 127-0-0-1.sslip.io. Use tools like curl to test the endpoint with crafted URLs that bypass string validation.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can exploit this to access internal HTTP services and exfiltrate sensitive data like cloud metadata or internal secrets. They can use hostnames that bypass string checks but resolve to internal IPs (e.g., 127-0-0-1.sslip.io). This includes retrieving cloud credentials or internal admin panel information without authentication.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exfiltration of internal data or credentials may result in compliance breaches, potential fines, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Next AI Draw.io to a version that resolves DNS before hostname validation. If upgrading is not possible, implement network-level restrictions to block outbound requests to internal IP ranges from the server. Disable or restrict access to the /api/parse-url endpoint if unused.

Useful 0 Not Useful 0