CVE-2023-0106

Executive Summary

CVE-2023-0106 is a stored Cross-site Scripting (XSS) vulnerability affecting the usememos/memos application, a self-hosted, lightweight memo/taking note platform. All versions prior to 0.10.0 are vulnerable. The flaw allows an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users who view the compromised content, leading to session hijacking, data exfiltration, and unauthorized administrative actions. CVSS score is 9.0, reflecting critical severity due to the network-based attack vector and high confidentiality, integrity, and availability impact. At the time of analysis, no public proof-of-concept, exploit code, or CISA KEV listing exists; however, the lack of patch evidence from all tracked sources is a significant concern for exposed deployments.

Technical Analysis

The vulnerability is classified as a stored (persistent) Cross-site Scripting (XSS) flaw in the usememos/memos web application. Stored XSS occurs when user-supplied input is accepted by the application, persisted to a data store (e.g., the application's database), and later rendered to other users without proper sanitization or output encoding. Attackers exploit this by submitting content containing malicious scripts—typically JavaScript embedded in HTML, SVG, or other markup—that passes validation at submission time and executes during subsequent rendering.

Mechanism of attack:

• The malicious script is stored server-side via the application's normal content submission functionality (e.g., creating a memo, editing a note, or uploading content).
• When another user retrieves or views the affected resource, the application renders the stored payload in their browser without neutralizing it.
• The script executes with the victim's session context, inheriting cookies, CSRF tokens, and any permissions the victim possesses within memos.

Attack surface: The primary attack surface is the web interface of the self-hosted memos instance. Because memos is designed for multi-user collaboration and sharing, any authenticated user—or potentially an unauthenticated user if the instance permits open registration—can serve as an attack vector. The stored nature of the payload means the attack is not limited to the submitting user; it propagates to all users who view the malicious content.

Code-level details are not available from the NVD description. However, based on the vulnerability class, the root cause is almost certainly a lack of input sanitization on submitted content coupled with absent output encoding at render time. Applications that allow HTML or Markdown rendering without configuring a strict allow-list or using a sanitization library (e.g., DOMPurify for JavaScript applications) are typical candidates for this flaw.

No specific function names, endpoints, or parameter names are disclosed in the NVD description. Insufficient technical detail is available to pinpoint the exact code path; the analysis above is derived from the stored XSS classification and standard web application security principles.

Exploitation Scenarios

No public PoC or exploit code is available, and the attack chain is inferred from the vulnerability class and the public description. The following steps describe a realistic exploitation scenario.

1. Reconnaissance/Target Identification: The attacker first identifies a publicly accessible usememos/memos instance. Shodan queries (e.g., title-based search) can locate exposed installations. The attacker then enumerates whether the instance allows new user registration or whether compromised credentials for an existing account are obtainable. If registration is open, the attacker creates an account; otherwise, credential stuffing or phishing may be used.

2. Triggering the Flaw: With authenticated access, the attacker navigates to a content-creation feature in the memos interface (e.g., creating a new memo or editing an existing note). The attacker crafts a payload that bypasses input validation on submission. Because the application fails to sanitize stored content, the payload is saved to the server-side data store. No special privileges beyond a standard user account are required.

3. Payload/Execution: The attacker injects a JavaScript payload embedded in the content. Example payload structure (vulnerability-class level, not product-specific):

   • An HTML <script> tag containing JavaScript.
   • An event handler attribute (e.g., onerror, onload) on an HTML element.
   • An iframe or img tag with a malicious src that fires on page load.
   • A crafted data: or javascript: URI in a link. The injected script executes when any user—including administrators—opens the memo list, retrieves the specific memo via the application's API, or triggers a search result that renders the content.

4. Post-Exploitation Impact: Depending on the privileges of the victim, the attacker can:

   • Steal session cookies via document.cookie and exfiltrate to an attacker-controlled server, enabling session hijacking.
   • Issue authenticated API requests on behalf of the victim, including creating new admin accounts if the victim is an administrator.
   • Deface the memo board, destroy data, or perform ransomware-style data deletion.
   • Leverage the compromised session to pivot to other internal systems if memos is deployed within a corporate network with broader reach.

The high CVSS availability impact (A:H) indicates that full compromise of the application or denial-of-service scenarios are plausible, e.g., by deleting all memos or rendering the interface unusable.

Impact Assessment

The CVSS score of 9.0 (critical) reflects an exploitable vulnerability with a network attack vector, low attack complexity, low privileges required, and user interaction required. The scope is changed, meaning the compromised component can impact resources beyond the memos application (e.g., a victim's browser can be used to attack other sites via CSRF or to exfiltrate data from other tabs if CORS policies are lax).

Business Impact:

• For organizations self-hosting memos for internal team collaboration, a successful attack grants attackers the ability to steal session tokens of any user, including administrators. This enables full administrative control: bulk data deletion, policy changes, and account takeover.
• For public-facing memos instances, the stored XSS can be used to distribute malware via drive-by downloads by injecting script that redirects victims to exploit kits.
• Compliance implications: if memos is used to store sensitive corporate data (e.g., meeting notes, credentials, or proprietary planning information), an XSS-based exfiltration could constitute a reportable data breach under regulations such as GDPR or HIPAA.

Affected Systems: All deployments of usememos/memos version 0.10.0 and earlier. This includes Docker container deployments, bare-metal installations, and any managed instances.

Blast Radius: The blast radius is amplified by the stored propagation model. A single malicious memo can compromise every user who views it. If admin accounts are compromised, the entire application and its underlying storage (e.g., the SQLite database or file system) are at risk. In self-hosted environments with network reachability to internal services, a compromised session can be leveraged for lateral movement.

Exploitation-in-the-Wild Status: As of the analysis date, there is no evidence of exploitation in the wild. EPSS score is 0.00645 (47.5th percentile), indicating low exploit likelihood overall. The CISA KEV catalog does not list CVE-2023-0106. No threat actor campaigns have been publicly associated with this CVE.

Detection Guidance

The following detection signatures are designed to identify common patterns of XSS exploitation. Because the stored payload is served as part of the application's response, network-based detection focuses on the server's responses containing suspicious script tags, while endpoint detection focuses on suspicious JavaScript execution in browser contexts.

Sigma Rule

title: Stored XSS Payload in Memos Application Response
id: 3f8b8f5e-6c2d-4e0a-9b7a-2f4c1d8e9a3b
status: experimental
description: Detects HTTP responses from a memos instance containing script tags or event handler attributes indicative of stored XSS payloads.
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains:
      - '/api/memo'
      - '/m/'
    cs-content-type: 'text/html'
    cs-body|contains:
      - '<script>'
      - 'onerror='
      - 'onload='
      - 'javascript:'
  condition: selection
falsepositives:
  - Legitimate use of JavaScript in user-generated content if the application intentionally allows it (unlikely for security-conscious deployments)
level: high
tags:
  - attack.t1059.007
  - cve.2023.0106

YARA Rule

rule CVE_2023_0106_Stored_XSS_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects script tags and common XSS payload fragments in memos application data files or exported backups."
        cve = "CVE-2023-0106"
        date = "2025-01-01"
        severity = "high"
    strings:
        $script_tag = "<script>"
        $onerror = "onerror="
        $onload = "onload="
        $javascript_uri = "javascript:"
        $document_cookie = "document.cookie"
        $fetch_exfil = "fetch("
        $xmlhttp = "XMLHttpRequest"
        $img_payload = "<img src=x"
    condition:
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A) and
        2 of ($script_tag, $onerror, $onload, $javascript_uri, $document_cookie) or
        (1 of ($script_tag, $onerror, $onload) and 1 of ($fetch_exfil, $xmlhttp, $img_payload))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-0106 Stored XSS Payload in Memos Response"; flow:established,to_client; content:"<script>"; http_response_body; content:"onerror"; http_response_body; distance:0; content:"document.cookie"; http_response_body; distance:0; classtype:web-application-attack; reference:cve,2023-0106; sid:20230106; rev:1;)

Elastic Detection

sequence by source.ip, destination.ip
  [network where event.category == "network" and network.protocol == "http" and
   http.request.method == "GET" and
   http.request.uri like~ "/api/memo*"]
  [http where event.category == "http" and
   http.response.status_code == 200 and
   http.response.body contains "<script>" and
   (http.response.body contains "onerror" or http.response.body contains "onload" or http.response.body contains "document.cookie")]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "/api/memo%") AND status=200
| rex field=_raw "(?i)(<script>|onerror=|onload=|javascript:)"
| eval suspicious=if(match(_raw, "(?i)(<script>|onerror=|onload=|javascript:)"), "true", "false")
| where suspicious == "true"
| table _time, src_ip, dest_ip, uri, method, status
| sort 0 _time desc

Wazuh OSSEC Rule

<group name="web_attack,">
  <rule id="202301" level="12">
    <if_sid>31100</if_sid>
    <match><script>|onerror=|onload=|javascript:</match>
    <description>CVE-2023-0106: Stored XSS payload detected in HTTP response from memos application.</description>
    <group>cve-2023-0106,xss,web_application_attack,</group>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence from any tracked source. The CNA advisory indicates the fix is expected in version 0.10.0, but the actual release and its content have not been verified. The following actions are recommended.

1) Immediate Mitigations:

• Disable publicly accessible memos instances: If the application does not need to be internet-facing, restrict network access via firewall rules to trusted internal networks only.
• Disable open registration: If user registration is enabled, turn it off. This reduces the ability for external attackers to create accounts and inject payloads.
• Restrict user permissions: Audit existing accounts and remove any that are not strictly necessary. Consider a content moderation workflow for multi-user environments.
• Web Application Firewall (WAF) rules: Deploy virtual patching via a WAF to block requests containing common XSS payload patterns and to inspect responses for script tags.
• Content Security Policy (CSP): Add a strict CSP header to the application's HTTP responses that disallows inline scripts (script-src 'self') to mitigate the impact if a payload is stored. Note that CSP does not prevent the vulnerability itself but neutralizes execution.

2) Patch/Upgrade Steps:

• Monitor the usememos/memos GitHub repository release notes for version 0.10.0.
• As soon as version 0.10.0 (or later) is released, test it in a staging environment and upgrade all production instances.
• If no patch is released within a reasonable timeframe, consider forking the repository and applying input sanitization (e.g., using DOMPurify for HTML rendering) and output encoding at all rendering points, or migrating to an alternative memo/note-taking platform with a demonstrated security track record.

3) Long-Term Hardening:

• Implement a proactive vulnerability management program that scans all self-hosted applications for known CVEs on a weekly basis.
• For memos specifically, enable two-factor authentication (2FA) for all accounts to reduce the impact of session hijacking.
• Segment the memos infrastructure from other internal systems to limit lateral movement post-compromise.
• Validate the integrity of the Docker image or installation binary by comparing checksums against the official release on a trusted channel.
• Establish a decommissioning policy: if the memos application is no longer actively needed, retire it rather than leaving an unpatched, exposed service running.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-0106
2. GitHub Repository usememos/memos: https://github.com/usememos/memos
3. CNA Advisory (huntr.dev): https://huntr.dev/bounties/ (search for CVE-2023-0106)
4. CISA Known Exploited Vulnerabilities Catalog (not listed as of analysis): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns have been associated with this CVE as of the analysis date. The absence of a confirmed patch and the criticality score warrant close monitoring; organizations running memos should treat this as an actively exploitable risk until the vendor releases and confirms the fix.