Memos EUVD-2026-53357

Exploitation requires the attacker to hold a low-privilege Memos user account with permission to create or modify webhook configurations (PR:L per CVSS). The webhook feature must be enabled and accessible to the attacker's account - in single-user Memos instances where the only user is also the administrator, the risk surface is limited to self-compromise. The attacker must additionally control a domain with a custom authoritative DNS server capable of serving different responses across two rapid successive queries (a short-TTL DNS rebinding setup). The timing window between safeDialContext()'s LookupHost() call and the subsequent DialContext() DNS re-resolution must be won; this window is implementation-dependent but typically milliseconds to low-second range. Exploitation is limited to Memos instances with multi-user access or where low-trust users can reach the webhook configuration UI. It does not require any specific non-default Memos configuration beyond webhook availability.

The vendor-assigned CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) accurately captures the network reach, scope change, and high confidentiality impact, but the AC:L designation warrants scrutiny. DNS rebinding attacks are not trivially reproducible - they require the attacker to control a domain with an authoritative DNS server capable of serving short-TTL responses and precise timing to win the TOCTOU race window. In practice, this raises the effective attack complexity above what AC:L implies. An independent assessment of AC:H is more accurate for this vulnerability class. No EPSS data was provided in source intelligence, and no CISA KEV listing exists, indicating no confirmed widespread exploitation at time of analysis. The realistic risk is elevated in Memos deployments that expose the webhook feature to untrusted or semi-trusted users (e.g., multi-tenant or team instances), since PR:L means any Memos account with webhook creation access is a potential attacker. Single-user or isolated deployments are significantly less exposed. The S:C flag correctly reflects that a successful exploit extends impact beyond the Memos process itself to internal network hosts.

An attacker with a Memos account registers an internet-facing domain (e.g., attacker.example) with a very short DNS TTL (e.g., 1 second) pointing to a legitimate public IP. They configure a Memos webhook pointing to this domain, which passes safeDialContext()'s validation since the resolved IP is non-reserved. Immediately before the webhook fires, the attacker updates the DNS record to resolve to an internal address (e.g., 192.168.1.1 - a router or internal API server). When net.Dialer.DialContext() performs its own lookup, it receives the internal IP and Memos connects to the internal target, allowing the attacker to probe or interact with internal services. No public POC was identified at time of analysis.