Vulnerability: Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.
Vulnerability ID: CVE-2022-1721
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/jgraph/drawio
Published: 2022-05-16
File: src/main/java/com/mxgraph/online/WellKnownServlet.java
Commit message: Limit wellknown servlet to serve single file
Commit author: David Benson

Vulnerable version (before fix):
 import javax.servlet.http.HttpServletResponse;  /**  * Servlet to fake a .well-known directory  */ @SuppressWarnings("serial") public class WellKnownServlet extends HttpServlet protected void doGet(HttpServletRequest request, 	{         // GAE can't serve dot prefixed folders         String uri = request.getRequestURI().replace("/.", "/");          if (uri.toLowerCase().contains(".json"))         {         	response.setContentType("application/json");         }          // Serve whatever was requested from .well-known         try (InputStream in = getServletContext().getResourceAsStream(uri))         {             if (in == null)             {             	response.sendError(404);                 return;             }                          byte[] buffer = new byte[8192];             int count;              while ((count = in.read(buffer)) > 0)             {             	response.getOutputStream().write(buffer, 0, count);             }                          response.getOutputStream().flush();             response.getOutputStream().close();         }     } }

Fixed version (after fix):
 import javax.servlet.http.HttpServletResponse;  /**  * Servlet to fake a .well-known directory, GAE does not directly support . prefixed directories  */ @SuppressWarnings("serial") public class WellKnownServlet extends HttpServlet protected void doGet(HttpServletRequest request, 	{         // GAE can't serve dot prefixed folders         String uri = request.getRequestURI().replace("/.", "/");                  // Currently, there is only one file that this servlet serves. This is only         // needed if you want OneDrive integration.          if (uri != null && uri.equals("/well-known/microsoft-identity-association.json"))         {             if (uri.toLowerCase().contains(".json"))             {                 response.setContentType("application/json");             }              // Serve whatever was requested from .well-known             try (InputStream in = getServletContext().getResourceAsStream(uri))             {                 if (in == null)                 {                     response.sendError(404);                     return;                 }                                  byte[] buffer = new byte[8192];                 int count;                  while ((count = in.read(buffer)) > 0)                 {                     response.getOutputStream().write(buffer, 0, count);                 }                                  response.getOutputStream().flush();                 response.getOutputStream().close();             }         }         else         {             response.sendError(404);             return;         }     } }

Patch:
patch: @@ -14,7 +14,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 /**
- * Servlet to fake a .well-known directory
+ * Servlet to fake a .well-known directory, GAE does not directly support . prefixed directories
  */
 @SuppressWarnings("serial")
 public class WellKnownServlet extends HttpServlet
@@ -38,31 +38,41 @@ protected void doGet(HttpServletRequest request,
 	{
         // GAE can't serve dot prefixed folders
         String uri = request.getRequestURI().replace("/.", "/");
-
-        if (uri.toLowerCase().contains(".json"))
-        {
-        	response.setContentType("application/json");
-        }
-
-        // Serve whatever was requested from .well-known
-        try (InputStream in = getServletContext().getResourceAsStream(uri))
+        
+        // Currently, there is only one file that this servlet serves. This is only
+        // needed if you want OneDrive integration. 
+        if (uri != null && uri.equals("/well-known/microsoft-identity-association.json"))
         {
-            if (in == null)
+            if (uri.toLowerCase().contains(".json"))
             {
-            	response.sendError(404);
-                return;
+                response.setContentType("application/json");
             }
-            
-            byte[] buffer = new byte[8192];
-            int count;
 
-            while ((count = in.read(buffer)) > 0)
+            // Serve whatever was requested from .well-known
+            try (InputStream in = getServletContext().getResourceAsStream(uri))
             {
-            	response.getOutputStream().write(buffer, 0, count);
+                if (in == null)
+                {
+                    response.sendError(404);
+                    return;
+                }
+                
+                byte[] buffer = new byte[8192];
+                int count;
+
+                while ((count = in.read(buffer)) > 0)
+                {
+                    response.getOutputStream().write(buffer, 0, count);
+                }
+                
+                response.getOutputStream().flush();
+                response.getOutputStream().close();
             }
-            
-            response.getOutputStream().flush();
-            response.getOutputStream().close();
+        }
+        else
+        {
+            response.sendError(404);
+            return;
         }
     }
 }
path: src/main/java/com/mxgraph/online/WellKnownServlet.java