CVE-2024-21635
📋 TL;DR
This vulnerability in Memos note-taking service allows attackers to maintain access to compromised accounts even after users change their passwords. Access tokens created before password changes remain valid, enabling persistent unauthorized access. All Memos users up to version 0.18.1 are affected.
💻 Affected Systems
- Memos
📦 What is this software?
Memos by Usememos
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover with persistent access despite password changes, allowing attackers to read, modify, or delete all user notes and data indefinitely.
Likely Case
Unauthorized access to sensitive notes and personal data, with attackers maintaining access until manually discovered and tokens revoked.
If Mitigated
Minimal impact if users manually review and delete suspicious access tokens immediately after password changes.
🎯 Exploit Status
Exploitation requires initial account compromise (stolen credentials) but token persistence is trivial once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/usememos/memos/security/advisories/GHSA-mr34-8733-grr2
Restart Required: No
Instructions:
No official patch available. Monitor GitHub repository for updates and apply when released.
🔧 Temporary Workarounds
Manual Token Review and Deletion
allManually review all access tokens after password changes and delete any suspicious or unrecognized tokens
Access Memos web interface > Settings > Access Tokens > Review and delete suspicious tokens
🧯 If You Can't Patch
- Implement mandatory token review process after every password change
- Enable multi-factor authentication if available to reduce initial compromise risk
🔍 How to Verify
Check if Vulnerable:
Check Memos version via web interface or configuration files. If version ≤ 0.18.1, system is vulnerable.Check Version:
Check web interface Settings > About or examine package/container versionVerify Fix Applied:
Test by creating an access token, changing password, and verifying old token becomes invalid (should fail authentication).📡 Detection & Monitoring
Log Indicators:
- Multiple access token creations from different IPs
- Password change events followed by successful authentication with old tokens
Network Indicators:
- Authentication requests using tokens created before password changes
SIEM Query:
source="memos" AND (event="password_change" OR event="token_auth") | stats count by user, token_age