Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Usememos Memos
cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*
|
— |
<= 0.30.0
|
References 4
https://github.com/usememos/memos/issues/6099
GitHub Issue #6099
https://github.com/usememos/memos/blob/v0.30.0/internal/httpgetter/html_meta.go
NVD
https://github.com/usememos/memos
NVD
https://www.vulncheck.com/advisories/memos-through-0.30.0-ssrf-via-omitted-cgna…
VulnCheck Advisory: Memos through 0.30.0 SSRF via Omitted CGNAT Address Range