Able to assign HOST role to new User in usememos/memos
Dec 27th 2022
As per the functionality we only can add user role as a "USER" in account Due to the no server side valaditon on "role" parameter , we can add new member as a "HOST" role with all HOST users privilege
Proof of Concept
- while adding new user intercept the request in burp
- change the POST body role paramater value as "HOST"
- the newaly added user have HOST users privilege
refer ss/Video POC : https://drive.google.com/drive/folders/1CqD7SKaBMx3ms7Px3vKFR-9puI_a0V-a?usp=sharing
Due to the issue , we can assign role as HOST to user . without having functionality.
after new role we can Delete old HOST role Account . example: demohero