CVE-2025-22952: 
NixOS vulnerability analysis and mitigation

Elestio memos v0.23.0 contains a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to access internal network resources. The vulnerability was discovered in February 2025 and affects both elestio/memos:latest and neosmemo/memos:latest Docker images (GitHub Issue).

The vulnerability exists in the GetLinkMetadata API endpoint due to insufficient validation of user-supplied URLs in the memos-main\plugin\httpgetter\html_meta.go file. The http.Get(urlStr) function within GetHTMLMeta does not properly restrict access to internal network resources, allowing attackers to make requests to arbitrary internal hosts and ports (GitHub Issue).

This vulnerability enables attackers to access internal network assets, perform internal network scanning, sniff web services on the internal network, and potentially access sensitive internal endpoints. Attackers can exploit this to gather information about the internal network infrastructure and potentially access restricted services (GitHub Issue).

The vulnerability can be exploited by sending specially crafted requests to the GetLinkMetadata API endpoint. An attacker can specify internal network URLs to probe internal services and ports. The vulnerability has been demonstrated to work against both HTTP and FTP services running on internal networks (GitHub Issue).

A fix has been implemented in pull request #4428 to prevent redirect attacks through the GetLinkMetadata API. The patch adds additional validation to prevent attackers from exploiting redirects to access internal network resources (GitHub PR). Users should upgrade to the latest version that includes this security fix.