PT-2024-22682 · Memos · Memos

Kevin Stubbings + 1 · Published 2024-04-18 · Updated 2025-03-26 · CVE-2024-29029

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions memos versions 0.13.2 through 0.21.x

Description memos is a privacy-first, lightweight note-taking service. An SSRF vulnerability exists at the "/o/get/image" API endpoint that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability.

Recommendations For memos versions 0.13.2 through 0.21.x, update to version 0.22.0 to resolve the issue. As a temporary workaround, consider disabling access to the "/o/get/image" API endpoint until a patch is available.

Exploit

Fix

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

CVE-2024-29029

GHSA-9CQM-MGV9-VV9J

GO-2024-3049

Affected Products

Memos

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29029.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos · Exploit
• https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-29029 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29029 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3049 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9cqm-mgv9-vv9j · Vendor Advisory
• https://github.com/usememos/memos · Note
• https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/http_getter.go#L29 · Note
• https://t.me/purp_sec/422 · Telegram Post
• https://twitter.com/GHSecurityLab/status/1781000239316451670 · Twitter Post
• https://github.com/advisories/GHSA-9cqm-mgv9-vv9j · Note
• https://t.me/cvenotify/106082 · Telegram Post
• https://t.me/cvenotify/88129 · Telegram Post