SiYuan Kernel Resource Exhaustion via Sprig Template Function

Executive Summary

SiYuan versions 3.1.12 through 3.8.5 are vulnerable to a Denial of Service (DoS) attack via the getDynamicIcon template function. The application fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing attackers to exploit uncapped functions like 'until' to exhaust system resources. This can lead to an Out-of-Memory (OOM) condition, crashing the kernel with a single request.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual memory consumption spikes or kernel crashes when accessing the /api/icon/getDynamicIcon endpoint. Check logs for requests with large content parameters or repeated calls to template functions like 'until'.

Useful 0 Not Useful 0

Impact Analysis

A publish reader or anyone when publish auth is disabled can send a crafted request to the /api/icon/getDynamicIcon endpoint with a large integer value in the content parameter. This causes the server's kernel process to terminate due to excessive memory consumption, crashing the owner's workspace. A single request can consume several gigabytes of memory.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes resource exhaustion leading to system crashes, which may disrupt availability of services handling sensitive data. For GDPR, this could impact the right to access or rectify data if services become unavailable. For HIPAA, it may affect the availability of electronic protected health information (ePHI) systems. However, the provided context does not explicitly link this vulnerability to compliance violations or specific regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.6 or later. If immediate upgrade is not possible, restrict access to the /api/icon/getDynamicIcon endpoint or disable publish authentication if not needed.

Useful 0 Not Useful 0