Vulnerability · Published Apr 19, 2024 · Assigned by GitHub_M

CVE-2024-29029memos vulnerable to an SSRF in /o/get/image

Medium 6.1

In plain English

A medium-severity server-side request forgery in memos from usememos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/usememos/memos	0.22.0	GHSA-9cqm-mgv9-vv9j
Go	github.com/usememos/memos	0.22.0	GO-2024-3049

Affected products (as reported)

Vendor	Product	Versions
usememos	memos	< 0.22.0

Weakness: CWE-918, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/ x_refsource_CONFIRM
https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5 x_refsource_MISC
https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/http_getter.go#L29 x_refsource_MISC