Improper Access Control in usememos/memos

Vulnerability

Overview

CVE-2023-4696 is an improper access control vulnerability in the usememos/memos application, affecting versions prior to 0.13.2. The root cause lies in the JWT middleware, where the validity of access tokens was not properly checked after parsing. Specifically, the code lacked a verification step for the accessToken.Valid field, allowing tokens that were expired, malformed, or otherwise invalid to be accepted as legitimate [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting or reusing an invalid access token (e.g., an expired token or one with manipulated claims) and presenting it to the server. Because the middleware did not validate the token's validity, the server would process the request as if the token were authentic. No special network access or prior authentication is required; the attacker only needs to send a request with the crafted token to any protected endpoint [2][3].

Impact

Successful exploitation allows an attacker to bypass authentication and gain unauthorized access to the application. Depending on the claims embedded in the token, the attacker could impersonate any user, potentially leading to data exposure, modification, or privilege escalation. This could compromise the confidentiality and integrity of the system [1][3].

Mitigation

The issue was fixed in commit c9aa2eeb9852047e4f41915eb30726bd25f07ecd, which adds a check for accessToken.Valid and returns an HTTP 401 Unauthorized error if the token is invalid [2]. Users are strongly advised to upgrade to version 0.13.2 or later, which includes this patch. No workarounds have been documented [1][3].