Reset API any user via IDOR in usememos/memos

Valid

Reported on

Dec 24th 2022

Description

Reset API any user without taking action from him via IDOR

1- Create a user

2- Go to setting

3- Open Burp Suite to object to the requisition

4- Click on it Reset API

5- Note that the endpoint is in the request PATCH/api/user/102

6- When the number that is in endpoint 102 changes to 103, we will notice that the Reset API has been made for other users

https://drive.google.com/file/d/1beJs4SkGjHd8w94cSBBXE2-yGXvmxaU7/view?usp=share_link

An attacker can make a Reset API for any user

We are processing your report and will contact the usememos/memos team within 24 hours. 16 days ago

We have contacted a member of the usememos/memos team and are waiting to hear back 15 days ago

samirwaleed modified the report

13 days ago

STEVEN validated this vulnerability 12 days ago

samirwaleed has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

STEVEN marked this as fixed in 0.9.1 with commit 3556ae 12 days ago

STEVEN has been awarded the fix bounty

This vulnerability has been assigned a CVE

STEVEN published this vulnerability 12 days ago

to join this conversation