Stored XSS in resource file uploading in usememos/memos


Reported on

Dec 24th 2022


The Resources upload feature does not restrict the type of uploaded file. An attacker can upload an html file and the browser still renders it. The CSP is set to default-src 'self' to prevent inline script execution. However, this can be easily bypassed by uploading a .js file then include it through the html file.

Proof of Concept

First we upload a malicious js file onto the server

// step1.js 

Then we upload a html file which includes this script

// step2.html
<script src=/path/step1.js></script>

The JavaScript code will be executed

Link POC

Video POC


Executing JavaScript in victim's session which leads to potential account takeover, perform actions as that user, ...

We are processing your report and will contact the usememos/memos team within 24 hours. a year ago
A GitHub Issue asking the maintainers to create a exists a year ago
STEVEN validated this vulnerability a year ago
Khang Tran has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Khang Tran
a year ago


May I request for a CVE?

STEVEN marked this as fixed in 0.10.0 with commit 46c13a a year ago
STEVEN has been awarded the fix bounty
This vulnerability has been assigned a CVE
STEVEN published this vulnerability a year ago
resource.go#L268 has been validated
to join this conversation