CVE-2024-29028: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta

August 5, 2024

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.

References

github.com/advisories/GHSA-6fcf-g3mp-xj2x
github.com/usememos/memos
github.com/usememos/memos/commit/6ffc09d86a1302c384ef085aa70c7bddb3ce7ba9
nvd.nist.gov/vuln/detail/CVE-2024-29028
securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos

Code Behaviors & Features

Detect and mitigate CVE-2024-29028 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →