Executive brief
Memos is an open-source note-taking application that automatically fetches metadata (titles, descriptions) from links users add to notes. A vulnerability in how it validates IP addresses before making these requests fails to block the 100.64.0.0/10 carrier-grade NAT range, allowing attackers to make the server request internal systems and cloud metadata services without authentication. An attacker can exploit this to read sensitive metadata and potentially access cloud credentials or internal service information.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) weakness in the link-metadata fetcher component (html_meta.go in internal/httpgetter). The IP validation logic fails to include the 100.64.0.0/10 carrier-grade NAT (CGN) address range in its blocklist of internal/reserved IP ranges, which is commonly used by cloud providers (AWS, GCP, Azure) for metadata services and internal networking. An unauthenticated attacker can craft a memo containing a URL pointing to an internal IP in the 100.64.0.0/10 range; when the server fetches metadata, it makes an outbound request to that address and returns page titles and descriptions. This allows attackers to probe cloud metadata endpoints (e.g., 169.254.169.254 equivalents), enumerate internal services, or extract sensitive information. The vulnerability requires no authentication and can be triggered by any user able to add links to memos.
Affected products
- usememos Memos through 0.30.0
Timeline
- 2026-08-29: disclosed