CVE-2022-4866

Executive Summary

CVE-2022-4866 is a stored Cross-site Scripting (XSS) vulnerability affecting the usememos/memos open-source note-taking and knowledge-management application. All versions prior to 0.9.1 are vulnerable, allowing an attacker to inject malicious scripts that persist in the application and execute in the browsers of authenticated users who view the injected content. The vulnerability carries a CVSS score of 9.8, reflecting the lack of authentication required for exploitation and the full confidentiality, integrity, and availability impact achievable. Despite the severity, no public proof-of-concept, no exploit-in-the-wild evidence, and no CISA KEV listing have been reported as of the intelligence cut-off date.

Technical Analysis

The vulnerability is characterized as a stored Cross-site Scripting (XSS) weakness in the usememos/memos repository. The NVD description confirms the flaw exists in versions prior to 0.9.1, with the fix intended to be shipped in release 0.9.1. The CNA title attributes this to the @huntrdev coordination platform, which identifies this class of vulnerability through responsible-disclosure processes.

Vulnerability Mechanism: Stored XSS occurs when user-supplied input is accepted by the application, persisted to storage (e.g., a database or file store), and later rendered to other users' browsers without adequate sanitization or output encoding. In the context of memos — a self-hosted web application for short-form notes/memos — the attack surface is the application's input fields for memo content, user profiles, or other comment/alias fields that support rich text or markup.

Because the NVD description does not specify the exact parameter, endpoint, or input field, the technical mechanism must be reasoned at the class level. The flaw likely resides in the application's handling of HTML, Markdown, or other markup input that is rendered client-side without neutralization. A typical vector would be the submission of a memo or note containing embedded <script> tags, onerror event handlers in <img> tags, or javascript: URIs in link attributes. The application fails to sanitize these inputs before persisting and before serving them back to other users during normal page render.

Attack Surface: The attack surface is the web frontend of memos, accessible over HTTP/HTTPS. Because memos is commonly deployed as a self-hosted application, the attacker requires network access to the application instance. The application may expose functionality for creating, editing, and sharing memos, all of which are potential injection points. Multi-user deployments where memos are shared between team members or publicly exposed significantly increase the exposure radius.

Privilege Context: The CVSS vector indicates a network-attack vector with low attack complexity, no privileges required, and no user interaction required for scoring purposes. This suggests that in a worst-case configuration, an unauthenticated attacker can inject the payload, and any user — including administrators — who views the content becomes a victim. The scope is unchanged, meaning the compromised execution stays within the application's security context.

CVSS Breakdown Rationale: Although the underlying weakness is a classic injection flaw, the 9.8 score reflects the high impact: a successful exploit can lead to session hijacking, account takeover, data exfiltration, or full application compromise if the stored XSS is chained with CSRF or other application-level weaknesses. The vector AV:N/AC:L/PR:N/UI:N indicates the accessibility of the vulnerability, while C:H/I:H/A:H reflects the potential impact on data and system availability.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker identifies a memos instance using search engines or Shodan-style scanning (e.g., searching for default titles, fingerprinting HTTP responses, or identifying the application's favicon hash). The attacker confirms the version is below 0.9.1, either by checking the application's footer, HTTP headers, or by probing version-specific endpoints (if discoverable). No public PoC exists, so the attacker must rely on fingerprinting and general stored XSS testing methodology.

Step 2 — Flaw Trigger (Injection): The attacker accesses the memo creation or editing functionality. Since the NVD description does not specify the exact input vector, the attack is executed at the class level: the attacker submits a memo containing a payload in a field that is stored and later rendered. The payload is designed to bypass input filters — for example, using HTML-entity-encoded JavaScript, event handler attributes, or obfuscated String.fromCharCode calls. Because no specific sanitization bypass is documented, the attacker would iterate with test payloads (e.g., <script>alert(1)</script>, <img src=x onerror=alert(1)>) to determine effective encoding and filter behavior.

Step 3 — Payload Execution: The payload is stored server-side. When any other user — including the application administrator — navigates to the page where the memo is rendered, the browser interprets the unsanitized markup. The injected JavaScript executes in the context of the victim's session. This results in the attacker's code running within the victim's authenticated session, enabling actions with the victim's privileges.

Step 4 — Post-Exploitation Impact: The executing script can:

• Steal session cookies (via document.cookie) and exfiltrate them to an attacker-controlled server.
• Intercept keystrokes or form submissions to capture credentials.
• Perform actions on behalf of the victim (e.g., creating or deleting memos, altering settings).
• If the victim is an administrator, the attacker may achieve full administrative control of the application, potentially leading to server-side code execution through further post-authentication exploitation.

It is important to note that no public PoC is available, and the attack chain above is inferred from the stored XSS vulnerability class. Actual exploitation details may differ based on the specific unpatched code paths in memos versions prior to 0.9.1.

Impact Assessment

Business Impact: Stored XSS in memos directly compromises the trust model of the application. Since memos is designed for personal and team note-taking, a successful attack can lead to the disclosure of sensitive intellectual property, credentials, and internal communications. For organizations deploying memos as a shared knowledge base, the integrity of that knowledge base is undermined — an attacker can inject misleading or malicious content that persists indefinitely.

Affected Systems: All deployments of usememos/memos versions prior to 0.9.1. This includes Docker-based self-hosted instances, local installs, and any public-facing deployments. The application's popularity in self-hosted and privacy-conscious communities increases the likelihood of internet-exposed instances.

Blast Radius: The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates:

• Confidentiality (H): Any data visible to the victim after payload execution (memos, settings, potentially API keys or tokens) is at risk of exfiltration.
• Integrity (H): The attacker can modify content, inject additional payloads, or alter application configuration.
• Availability (H): A destructive payload could delete memos, corrupt data, or render the application unusable; additionally, the ability to execute JavaScript in an admin context could facilitate resource exhaustion or system compromise.

Real-World Considerations: The EPSS score of 0.00991 (59.3rd percentile) suggests that although this CVE is not among the most actively exploited, it is more likely to be targeted than roughly 59% of known vulnerabilities. The absence of CISA KEV listing and lack of PoC/public exploit code reduce the immediate threat, but the high CVSS score and the application's authentication-free (for reading) nature in many deployments make it a valuable target for opportunistic attackers.

Detection Guidance

The following detection rules target behavioral indicators and network signatures associated with stored XSS exploitation. Because no exact URL paths or parameter names are documented for this CVE, the rules are written to detect generic payload patterns in HTTP POST/GET requests and in application responses, which is the appropriate level of abstraction given available data.

Sigma Rule

title: Stored XSS Attempt - Payload Injection to Memos
id: 9f2fac3a-7f5e-4b0a-9a1c-3d8e7f2a4b6c
status: experimental
description: Detects HTTP requests containing common XSS payload patterns to memo creation endpoints, indicative of CVE-2022-4866 exploitation.
logsource:
  category: webserver
  product: generic
detection:
  selection:
    http.request.body|contains:
      - '<script>'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'prompt('
      - 'alert('
      - 'document.cookie'
  condition: selection
fields:
  - client.ip
  - http.request.body
  - http.url
falsepositives:
  - Legitimate web application content containing '<script>' in documentation or code-sharing features.
  - Security scanning tools.
level: high
tags:
  - attack.t1190
  - attack.t1059.007

YARA Rule

rule CVE_2022_4866_Stored_XSS_Payloads {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects common XSS payload patterns associated with CVE-2022-4866 in web request bodies and responses."
        date = "2025-04-09"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-4866"
    strings:
        $s1 = "<script>" ascii nocase
        $s2 = "onerror=" ascii nocase
        $s3 = "onload=" ascii nocase
        $s4 = "javascript:" ascii nocase
        $s5 = "document.cookie" ascii nocase
        $s6 = "String.fromCharCode" ascii nocase
        $s7 = "<img src"
        $s8 = "src=x onerror"
    condition:
        any of them and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2022-4866 - Stored XSS Payload Injection"; flow:to_server,established; content:"<script>"; nocase; http_request_body; content:"onerror"; nocase; http_request_body; content:"document.cookie"; nocase; http_request_body; pcre:"/<(script|img|svg)[^>]*(onerror|onload|javascript:|document\.cookie)/i"; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2022-4866; classtype:web-application-attack; sid:20260409; rev:1;)

Note: This rule triggers on POST requests containing multiple XSS indicators. High false-positive potential; tune with additional context (e.g., User-Agent, URI path) in production.

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where protocol == "http" and
   event.type in ("start", "info") and
   request.body like "*<script>*" and
   request.body like "*onerror*"]
  [http where event.action in ("read", "write") and
   response.body like "*<script>*"
  ]

Splunk SPL Query

index=web sourcetype="access_combined_wcookie" OR sourcetype="iis" 
| where like(_raw, "%<script>%") OR like(_raw, "%onerror=%") OR like(_raw, "%javascript:%") 
| search NOT user_agent="*nuclei*" NOT user_agent="*sqlmap*" NOT user_agent="*burpsuite*"
| table _time, clientip, method, uri_path, uri_query, status, user_agent
| eval xss_indicators = if(match(_raw, "(?i)<script>|onerror=|onload=|javascript:|document\\.cookie"), 1, 0)
| where xss_indicators == 1
| stats count by clientip, uri_path
| sort -count

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100486" level="10">
    <decoded_as>json</decoded_as>
    <match>server</match>
    <field name="url">\./memos</field>
    <regex>((&lt;script&gt;)|(onerror=)|(onload=)|(javascript:)|(document\.cookie))</regex>
    <description>CVE-2022-4866: Stored XSS payload attempted against memos application</description>
    <mitre>
      <id>T1190</id>
      <id>T1059.007</id>
    </mitre>
    <group>web_application_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — No patch evidence from any tracked source. The NVD description indicates the fix is intended for version 0.9.1, but there is no confirmation that this version addresses all exploitation paths, and no vendor advisory or commit reference is available.

1. Immediate Mitigations (defense before patch):

• Restrict network access: If the memos instance does not need to be internet-facing, isolate it on a private network or behind a VPN. Restrict access via firewall ACLs to only trusted IP ranges.
• Enable application-level WAF: Deploy a Web Application Firewall (e.g., ModSecurity with OWASP CRS) in front of the memos instance, with rules to block XSS payload patterns (e.g., <script>, onerror=, javascript:).
• Disable JavaScript rendering in external integrations: If memos supports integrations or embeds that render content from other sources, disable or restrict them.
• Implement Content Security Policy (CSP): If the application supports custom HTTP headers, inject Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' — note that this may break legitimate functionality if inline scripts are used, so test in staging first.
• Monitor access logs: Actively review web logs for the payload patterns listed in the detection rules above, as well as for unusual spikes in HTTP 4xx/5xx responses from the memo creation endpoints.

2. Patch/Upgrade Steps:

• Monitor the official usememos/memos GitHub repository for the release of version 0.9.1 or later. As of the report date, this version is not confirmed available or verified as a complete fix.
• If version 0.9.1 (or a later patched release) becomes available, upgrade immediately. For Docker deployments: pull the updated image, back up the data volume, and restart the container with the new image.
• After upgrading, verify the application version via its UI or API and retest previously identified injection points to confirm sanitization is effective.
• If the patch is unavailable, do not expose the application to the public internet. Treat the application as compromised if any untrusted user has interacted with it.

3. Long-Term Hardening:

• Adopt a vulnerability management cadence: Subscribe to release notifications for usememos/memos and schedule regular upgrading windows.
• Implement security headers: Ensure the application sets X-XSS-Protection: 0 (modern browsers disable XSS auditor) but rely on proper output encoding and CSP. Verify CSP is set to script-src 'self' with no unsafe-inline.
• Conduct code review / audit: For organizations using memos in a production capacity, commission a third-party security audit of the application to identify additional unpatched injection points.
• Enable comprehensive logging: Ensure access logs, application logs, and error logs are centralized and retained for at least 90 days for post-incident analysis.
• Investigate alternative solutions: If memos is unsupported or the patch remains unavailable for an extended period, consider migrating to a maintained alternative (e.g., Trilium Notes, Joplin Server) that demonstrates an active security response process.

References

1. NVD Entry (Primary): https://nvd.nist.gov/vuln/detail/CVE-2022-4866 — Contains the official CVE description, CVSS scoring, and affected version information.
2. GitHub Repository (Indirect): https://github.com/usememos/memos — The vendor repository. Monitor releases page for version 0.9.1 and any security advisories.
3. huntr.dev Coordination (Indirect): https://huntr.com — The platform through which this vulnerability was coordinated (per CNA title). Search for "usememos/memos" for advisory details if published.
4. FIRST EPSS (Input Reference): https://www.first.org/epss/ — EPSS score reference for CVE-2022-4866 (0.00991, 59.3rd percentile).
5. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Verified as NOT listed; monitor this page for updates.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this report, there is no known threat actor campaign leveraging CVE-2022-4866, no public exploit code, and no exploit-in-the-wild evidence. The vulnerability is unpatched per tracked sources, but the absence of PoCs reduces near-term exploitation risk; however, it should be treated as a latent high-impact risk given the CVSS 9.8 rating.