CVE-2023-4696 PoC — memos 访问控制错误漏洞

Description

https://medium.com/@mnqazi/cve-2023-4696-account-takeover-due-to-improper-handling-of-jwt-tokens-in-memos-v0-13-2-13104e1412f3

介绍

# CVE-2023-4696
# Account Takeover Due to Improper Handling of JWT Tokens in memos < v0.13.2
## Description
I want to shed light on a significant security vulnerability I recently discovered within the usememos/memos system. This vulnerability has the potential to allow any user to modify another user’s data, including their password, with relative ease. By exploiting this flaw, attackers could gain unauthorized access to sensitive information, leading to a host of security and privacy concerns. Let’s dive into the details of this discovery.
At the heart of this vulnerability is the handling of JSON Web Tokens (JWTs), a commonly used mechanism for secure data exchange. In the usememos/memos system, the server fails to adequately verify whether the JWT token has been legitimately issued. This omission means that even a modified JWT, created using tools like https://token.dev, can pass through the system’s defenses.

## Proof of Concept
[![Video Thumbnail](http://img.youtube.com/vi/wV1RPv-ezc4/0.jpg)](https://youtu.be/wV1RPv-ezc4)

 ## Impact
The consequences of this vulnerability are far-reaching and can have a significant impact on the security and privacy of the affected system:

Account Takeover: An attacker armed with a forged JWT token can easily change the password of any user. This essentially grants them full control over the affected user’s account.
Privacy Violations: Unauthorized modifications to a user’s email address can result in serious privacy breaches, exposing sensitive information without the user’s consent.
Data Breaches: Changing a user’s email address can lead to unauthorized access to their sensitive information, potentially culminating in a data breach. Such breaches can have severe legal and financial consequences for both users and the organization.
Reputation Damage: In addition to the aforementioned risks, attackers may exploit this vulnerability to defame users or tarnish the organization’s reputation, potentially causing long-lasting damage.

## References

For more details on this vulnerability, please refer to the following resources:
- [huntr.dev Report](https://huntr.dev/bounties/4747a485-77c3-4bb5-aab0-21253ef303ca/)
- [Medium Blog - Account Takeover Due to Improper Handling of JWT Tokens in memos < v0.13.2](https://medium.com/@mnqazi/cve-2023-4696-account-takeover-due-to-improper-handling-of-jwt-tokens-in-memos-v0-13-2-13104e1412f3)

You can also follow me for updates on my research and other security-related topics:

- Instagram: [@mnqazi](https://www.instagram.com/mnqazi)
- Twitter: [@mnqazi](https://twitter.com/mnqazi)
- Facebook: [@mnqazi](https://www.facebook.com/mnqazi)
- LinkedIn: [M Nadeem Qazi](https://www.linkedin.com/in/m-nadeem-qazi)

Let's prioritize security and protect our systems from potential threats. Stay vigilant! 💻🔒

文件快照

备注