CVE-2024-29029: GHSL-2023-154_GHSL-2023-156: Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) in memos API - CVE-2024-29028, CVE-2024-29029, CVE-2024-29030
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.
Other sources
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.
— GitHub
Multiple SSRF vulnerabilities exist in the memos API service that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the administrator account.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29029?
CVE-2024-29029 is rated with a high severity due to its ability to facilitate unauthorized access and enumeration of internal network resources.
How do I fix CVE-2024-29029?
To fix CVE-2024-29029, upgrade to memos version 0.22.0 or later, where the vulnerability has been patched.
What type of vulnerability is CVE-2024-29029?
CVE-2024-29029 is an SSRF (Server-Side Request Forgery) vulnerability affecting the memos note-taking service.
Who is affected by CVE-2024-29029?
Users of memos versions prior to 0.22.0 are affected by CVE-2024-29029.
Can unauthenticated users exploit CVE-2024-29029?
Yes, CVE-2024-29029 can be exploited by unauthenticated users, allowing them to enumerate the internal network.