CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to exploit the link-metadata fetcher in Memos versions up to 0.30.0 by bypassing IP validation for the 100.64.0.0/10 carrier-grade NAT address range. This could enable attackers to access internal hosts, including cloud metadata services, potentially exposing sensitive information. Organizations using Memos should prioritize addressing this vulnerability to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.