| 标题 | Usememos Memos 0.22.1 Cross Site Scripting |
|---|
| 描述 | A critical vulnerability has been discovered in usememos/memos (versions up to and including 0.22.1). This security flaw involves a combination of Broken Access Control (CWE-284) and Stored Cross-Site Scripting (CWE-79).
The backend gRPC-web endpoint 'UpdateInstanceSetting' fails to properly validate user permissions, allowing a standard 'Member' user to bypass the frontend UI restrictions and modify global instance settings. Specifically, an attacker can navigate to the system settings page and inject malicious JavaScript or CSS into the 'additionalStyle' or 'additionalScript' fields.
Because the frontend application (src/App.tsx) injects these settings directly into the DOM using the 'innerHTML' property without sanitization, the malicious code is executed in the context of every user visiting the site (including administrators). This allows for full session hijacking, credential theft (memos_access_token), and unauthorized administrative actions.
2. Short Summary (Submission Title/Summary Field)
Critical vulnerability chain in usememos/memos allows unprivileged users to perform Stored XSS and hijack global instance settings due to broken access control on the UpdateInstanceSetting gRPC-web endpoint.
3. Quick Reference for VulDB Fields
Class: Web Application
Type: Stored XSS / Broken Access Control
CWE: CWE-79 / CWE-284
Impact: Critical (Full System/Session Compromise)
CVSS v3.1/4.0: ~9.0 |
|---|
| 来源 | ⚠️ https://github.com/Dave-gilmore-aus/security-advisories/blob/main/usememos-security-advisory |
|---|
| 用户 | davidgilmore (UID 96940) |
|---|
| 提交 | 2026-03-31 07時22分 (21 日前) |
|---|
| 管理 | 2026-04-19 21時17分 (20 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 358268 [usememos 直到 0.22.1 UpdateInstanceSetting src/App.tsx memos_access_token additionalStyle/additionalScript 权限提升] |
|---|
| 积分 | 20 |
|---|