Unauthorized Attacker Can Change Visibility Status of Victim's Memos in usememos/memos

Valid

Reported on

Dec 26th 2022


An attacker can make a private memo into a public memo in order to view it. All the attacker needs to know is the memo ID and they can make a PATCH request to /api/memo/<memo ID> with the following request data:

{"id":<MEMO ID>,"visibility":"PUBLIC","resourceIdList":[]}

Then the attacker can visit the memo URL & view the memo data of the victim. The memo URL format is similar to this: https://demo.usememos.com/m/<MEMO ID>.

Reproduction Steps

1. Create two accounts: testdemouser1 & testdemouser2
2. On testdemouser1, create a private memo
3. From the testdemouser2 account, make a PATCH request to the `/api/memo<memo ID>` endpoint with the request data mentioned earlier, filling out the appropriate memo ID parameters
4. Then from testdemouser2, access the memo. You should now be able to access the memo which was meant to be private.

Impact

Exploiting this vulnerability, an attacker can view potentially sensitive information which was contained within the memo of a victim.

We are processing your report and will contact the usememos/memos team within 24 hours. 14 days ago
We have contacted a member of the usememos/memos team and are waiting to hear back 13 days ago
STEVEN validated this vulnerability 12 days ago
1d8 has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
STEVEN marked this as fixed in 0.9.1 with commit 3556ae 12 days ago
STEVEN has been awarded the fix bounty
This vulnerability has been assigned a CVE
STEVEN published this vulnerability 12 days ago
to join this conversation