CVE-2024-41659 GHSL-2024-034: memos CORS Misconfiguration in server.go

High 8.1 Published 20 Aug 2024 Updated 9 Jan 2025

An attacker can read private data or modify system state via cross-origin requests due to insecure CORS settings in the Memos web application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-41659?

CVE-2024-41659 is a high-severity vulnerability in Usememos Memos, published on 20 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.

Weakness: CWE-942

Which versions are affected by CVE-2024-41659?

3 open source packages ship an affected version, including github.com/usememos/memos. It affects 1 product.

Package	Affected	Fixed in
`github.com/usememos/memos` Go	All versions	`0.21.0`
`github.com/usememos/memos` Go	All versions	`0.21.0`
`github.com/usememos/memos` Go	All versions	`0.21.0`

Products include Usememos Memos.

How do I fix CVE-2024-41659?

Upgrade github.com/usememos/memos to 0.21.0 or later.

Is CVE-2024-41659 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41659 exists.

All Usememos Memos vulnerabilities

Sources

Also known as GHSA-p4fx-qf2h-jpmj, GO-2024-3088.