CVE-2023-0109 Stored XSS in usememos/memos

Critical 9.8 Published 15 Nov 2024 Updated 15 Nov 2024

Attackers can inject malicious scripts via uploaded files, leading to credential theft and session hijacking for users of the Memos web application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-0109?

CVE-2023-0109 is a critical cross-site scripting vulnerability in Usememos Memos, published on 15 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

Weakness: CWE-79

Which versions are affected by CVE-2023-0109?

3 open source packages ship an affected version, including github.com/usememos/memos. It affects 1 product.

Package	Affected	Fixed in
`github.com/usememos/memos` Go	All versions	`0.10.0`
`github.com/usememos/memos` Go	All versions	`0.10.0`
`github.com/usememos/memos` Go	All versions	`0.10.0`

Products include Usememos Memos.

How do I fix CVE-2023-0109?

Upgrade github.com/usememos/memos to 0.10.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-0109 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0109 exists.

All Usememos Memos vulnerabilities

Sources

Also known as GHSA-5r2g-59px-3q9w, GO-2024-3274.