CVE-2024-29028
Published: 19 April 2024
Summary
CVE-2024-29028 is a medium-severity SSRF (CWE-918) vulnerability in Usememos Memos. Its CVSS base score is 5.8 (Medium).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-29028 is a server-side request forgery vulnerability in the memos note-taking service, specifically affecting version 0.13.2 at the /o/get/httpmeta endpoint. The flaw permits unauthenticated network requests that can reach internal hosts and return limited HTML metadata in JSON format, corresponding to CWE-918 with a CVSS 3.1 score of 5.8.
An attacker with no credentials can send crafted requests to the endpoint and use the responses to enumerate internal network resources, obtaining partial content from otherwise unreachable systems. Because the attack requires no authentication or user interaction and crosses trust boundaries, it enables reconnaissance that could support further targeted exploitation inside the affected environment.
The referenced GitHub Security Lab advisory and the fixing commit in memos 0.16.1 indicate that the issue was resolved by updating request handling logic to prevent unauthorized outbound fetches from the endpoint.
EPSS scores for the CVE reached a peak of 0.0801 after disclosure before settling at the current value of 0.0606, indicating measurable post-publication interest in exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2512
Vulnerability details
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.