CVE-2022-4802

Executive Summary

CVE-2022-4802 is an authorization bypass vulnerability affecting usememos/memos, an open-source self-hosted note-taking and knowledge management application, in versions prior to 0.9.1. The flaw is categorized as an "Authorization Bypass Through User-Controlled Key" (CWE-639), indicating that the application fails to properly validate whether an authenticated user has permission to access resources referenced by user-controlled identifiers. With a CVSS score of 9.1, this vulnerability allows an unauthenticated or low-privileged attacker to access or modify resources belonging to other users, leading to potential data confidentiality and integrity compromise. The vulnerability is remotely exploitable over the network without requiring user interaction or special privileges, making it a critical risk for any organization that has deployed an affected version of memos.

Technical Analysis

The vulnerability class CWE-639 (Authorization Bypass Through User-Controlled Key) describes a scenario where an application uses a user-supplied identifier — such as a numeric ID, UUID, or resource key — directly in access control decisions without verifying ownership. In the context of usememos/memos, the application exposes APIs that allow clients to retrieve, update, or delete memo entries, resources, or user profiles. If the authorization layer relies solely on the client-supplied object identifier (e.g., a memo ID) and fails to bind that identifier to the authenticated session's user context, an attacker can enumerate identifiers belonging to other users and perform unauthorized operations.

The NVD description does not provide specific endpoint paths, function names, or parameter details for this vulnerability. However, the vulnerability class implies the following mechanism:

1. Identifier Enumeration: Memos, like many note-taking applications, use sequential or predictable numeric identifiers for stored objects.
2. Missing Ownership Check: The API handler accepts a request containing a target object ID and executes the operation without verifying that the authenticated user owns (or has been granted access to) that object.
3. Direct Object Reference: The attacker modifies a predictable parameter (e.g., memo ID in a GET/DELETE request) to reference another user's resource.

The attack surface is the web application's REST API exposed on the default memos port (typically TCP 5230). Since memos is designed as a self-hosted application, many instances are exposed directly to the internet via port forwarding or reverse proxies. The application is typically deployed as a single binary or Docker container, and authentication is handled through a session cookie or API token. The vulnerability bypasses this authentication boundary at the object-level authorization layer.

Given the CVSS vector components implied by the score (Network attack vector, Low attack complexity, No privileges required, No user interaction required, High Confidentiality impact, High Integrity impact), this is a critical flaw that can be exploited remotely without authentication in the worst case, though the CWE-639 class typically requires at least a valid session to reach authorized endpoints.

Exploitation Scenarios

Prerequisite: The target must be running usememos/memos version prior to 0.9.1. No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class.

Step 1 — Reconnaissance / Target Identification: An attacker identifies internet-facing memos instances using search engines (e.g., Shodan query: http.title:"memos") or by scanning common ports (5230, 80, 443) for the application's distinctive web interface. The attacker confirms the version by examining the "About" page, HTML source comments, or API response headers.

Step 2 — Triggering the Flaw Class: The attacker authenticates to the application using their own valid account (self-registration is often enabled by default in memos). After authentication, the attacker captures legitimate API requests that reference resources by ID — for example, a GET request to retrieve memo details. The request URL pattern follows a predictable resource/ID structure.

Step 3 — Payload / Execution Method: The attacker manipulates the user-controlled key (the resource ID) in the request. For example, if the attacker's own memo has ID 100, they modify the request to reference ID 99, 98, or systematically enumerate IDs downward. If the application fails to verify that the memo belongs to the authenticated user, the server returns the victim's memo content. For DELETE or PUT operations, the attacker could modify or destroy other users' data. The exploitation requires only standard HTTP request manipulation — no special payloads, injection strings, or binary exploits.

Step 4 — Post-Exploitation Impact: The attacker achieves unauthorized read access to all memo content of all users on the instance, which may include credentials, internal network information, personal data, or business secrets. If the same vulnerability extends to file attachments, the attacker could download uploaded files. With Integrity impact, the attacker could also alter or delete memos, potentially causing data loss or injecting malicious content into the application (e.g., stored XSS payloads that execute in other users' browsers when they view tampered memos).

Confidence Note: No public PoC is available. The attack chain described is based strictly on the CWE-639 vulnerability class and the NVD description. Specific API paths and parameter names are unknown.

Impact Assessment

• Confidentiality (High): All memos and associated data created by any user on the instance are readable by any other authenticated user. In shared or corporate deployments, this exposes internal notes, meeting records, credentials, and potentially proprietary information.
• Integrity (High): An attacker can modify or delete any memo, leading to data loss or the injection of deceptive or malicious content. Tampered memos could damage business records or be leveraged for further attacks (e.g., social engineering via crafted content).
• Availability (Unspecified, likely Low-Moderate): While not the primary impact, bulk deletion of memos could result in denial of service for the application's legitimate users.
• Attack Complexity (Low): Exploitation requires no special technical skill beyond HTTP request manipulation. The predictable nature of sequential IDs makes enumeration trivial.
• Blast Radius: For multi-tenant deployments (e.g., a company hosting memos for all employees), the entire data store is compromised. For personal single-user instances, the impact is reduced but still critical if the instance is internet-exposed.
• CVSS 9.1 Critical: This score reflects the network exploitability, low complexity, no privilege requirement (beyond a basic account), and high confidentiality/integrity impact.

Detection Guidance

The following detection rules target the exploitation pattern of sequential identifier enumeration characterized by rapid, repetitive requests to resource endpoints with incrementing or decrementing numeric IDs.

Sigma Rule

title: Memos Authorization Bypass - Sequential ID Enumeration
id: 7e4c5a9f-2b3d-4e8a-9c1f-6d5b2a8e4c71
status: experimental
description: Detects rapid sequential requests to memos resource endpoints indicating enumeration of object IDs (CVE-2022-4802).
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection:
    c-uri|contains:
      - '/api/memo/'
      - '/api/resource/'
    sc-status: 200
  filter_known_user:
    cs-username|contains: 'valid_user'
  condition: selection and not filter_known_user
  timeframe: 1m
  aggregation:
    groupby:
      - clientip
      - c-uri
    count: 20
level: high
falsepositives:
  - Legitimate bulk export tools or scripts that read all memos
  - Application backup processes
fields:
  - clientip
  - c-uri
  - cs-username
tags:
  - attack.t1190
  - cve.2022-4802
  - cwe.639

YARA Rule

rule Memos_Authorization_Bypass_Enumeration_Signature
{
    meta:
        author = "Valter Sit Threat Intelligence"
        description = "Detects HTTP requests indicative of sequential ID enumeration against usememos/memos (CVE-2022-4802)"
        score = 60
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-4802"
        date = "2025-01-27"
    strings:
        $api_path_memo = "/api/memo/" ascii wide
        $api_path_resource = "/api/resource/" ascii wide
        $api_path_user = "/api/user/" ascii wide
        $http_get = "GET" ascii
        $http_delete = "DELETE" ascii
        $http_patch = "PATCH" ascii
        $http_put = "PUT" ascii
        $numeric_pattern = /\/api\/memo\/\d{1,6}/ ascii
    condition:
        uint16(0) == 0x5a4d and
        any of ($api_path_*) and any of ($http_*) and any of ($numeric_pattern)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Memos CVE-2022-4802 Authorization Bypass - ID Enumeration"; flow:established,to_server; content:"GET"; http_method; content:"/api/memo/"; http_uri; pcre:"/\/api\/memo\/\d{1,6}$/U"; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-recon; sid:20224802; rev:1; metadata:created_at 2025_01_27, cve CVE-2022-4802, cwe CWE-639;)

Elastic Detection

// EQL query for Elastic Security - detect sequential ID enumeration
sequence by source.ip with maxspan=60s
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]
  [http where request.method == "GET" and request.path like "/api/memo/*"]

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=uri_path "(?<endpoint>\/api\/memo\/)(?<memo_id>\d+)"
| where isnotnull(memo_id)
| eval memo_id_num = tonumber(memo_id)
| stats count, dc(memo_id_num) as unique_ids, max(memo_id_num) as max_id, min(memo_id_num) as min_id by src_ip
| where count > 15 and unique_ids > 5
| eval range_diff = max_id - min_id
| where range_diff < count OR unique_ids > 10
| table _time, src_ip, count, unique_ids, min_id, max_id, range_diff
| sort - count

Wazuh OSSEC Rule

<group name="web,memos,">
  <rule id="100482" level="12" frequency="15" timeframe="60">
    <if_matched_sid>31100</if_matched_sid>
    <match>/api/memo/</match>
    <description>Memos CVE-2022-4802 - Possible sequential ID enumeration detected from same source</description>
    <group>attack.t1190,cve.2022-4802,cwe.639,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source)

Note: The NVD description states the vulnerability affects versions "prior to 0.9.1," indicating that version 0.9.1 contains the fix. However, our tracked patch sources have not yet confirmed this fix, and no official patch advisory has been retrieved.

1. Immediate Mitigations (apply today):

   • Upgrade to usememos/memos version 0.9.1 or later as referenced in the NVD description. If an upgrade path is blocked, restrict network access to the memos instance — place it behind a VPN, firewall, or reverse proxy requiring additional authentication (e.g., mTLS, IP allowlist).
   • Disable self-registration if the application permits it. This reduces the attacker pool to pre-provisioned accounts.
   • Review current user list and audit logs for unauthorized account creation — a precursor to exploitation.
   • Monitor access logs for the enumeration pattern described in the Detection Guidance section.

2. Patch/Upgrade Steps:

   • Backup the memos database and file storage.
   • Upgrade to version 0.9.1 or latest release (following official upgrade documentation at https://github.com/usememos/memos).
   • After upgrade, conduct a security test: authenticate as one user and attempt to access another user's memo by direct URL manipulation.
   • Validate that all API responses enforce ownership before returning data.

3. Long-Term Hardening:

   • Apply the principle of least privilege: disable self-registration in production, enforce strong passwords, and use SSO (OIDC/LDAP) if supported.
   • Implement a Web Application Firewall (WAF) rule that rate-limits requests to resource endpoints and blocks patterns of sequential ID traversal.
   • Enable comprehensive audit logging for all API access; retain logs centrally for incident response.
   • Regularly check for upstream security advisories from the usememos project and subscribe to their security mailing list (https://github.com/usememos/memos/security).
   • Consider running memos in an isolated network segment where its exposure to the internet is minimized.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-4802
2. Huntr Vulnerability Report (CNA): https://huntr.dev/bounties/
3. usememos/memos GitHub Repository: https://github.com/usememos/memos
4. usememos/memos Releases (for version 0.9.1 fix): https://github.com/usememos/memos/releases
5. CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html

Threat Actor Intelligence: No known threat actor campaigns or exploit-in-the-wild evidence is associated with CVE-2022-4802. EPSS score of 0.00568 (43.9th percentile) indicates relatively low exploitation likelihood in the wild. CISA KEV (Known Exploited Vulnerabilities) does not include this CVE. No public PoC, exploit code, or Nuclei template is available.