Nixpkgs security tracker
3.4 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.
References
-
https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x x_refsource_CONFIRM
-
https://github.com/jgraph/drawio/issues/493 x_refsource_MISC
-
https://github.com/jgraph/drawio/releases/tag/v29.7.9 x_refsource_MISC
Affected products
- ==< 29.7.9
Matching in nixpkgs
pkgs.drawio
Desktop version of draw.io for creating diagrams
pkgs.drawio-headless
xvfb wrapper around drawio
pkgs.pandoc-drawio-filter
Pandoc filter which converts draw.io diagrams to PDF
pkgs.python312Packages.mkdocs-drawio-file
Embedding files of Diagrams.net (Draw.io) into MkDocs
pkgs.python313Packages.mkdocs-drawio-file
Embedding files of Diagrams.net (Draw.io) into MkDocs
pkgs.python314Packages.mkdocs-drawio-file
Embedding files of Diagrams.net (Draw.io) into MkDocs
pkgs.vscode-extensions.hediet.vscode-drawio
This unofficial extension integrates Draw.io into VS Code
pkgs.python312Packages.mkdocs-drawio-exporter
Module for exporting Draw.io diagrams
pkgs.python313Packages.mkdocs-drawio-exporter
Module for exporting Draw.io diagrams
pkgs.python314Packages.mkdocs-drawio-exporter
Module for exporting Draw.io diagrams
Package maintainers
-
@DarkOnion0 Alexandre Peruggia <darkgenius1@protonmail.com>
-
@tfc Jacek Galowicz <jacek@galowicz.de>
-
@snpschaaf Philippe Schaaf <philipe.schaaf@secunet.com>
-
@TheMaxMur Maxim Muravev <muravjev.mak@yandex.ru>