SiYuan Cookie Replay Leading to Admin Session Hijack

Executive Summary

SiYuan versions 2.1.0 through 3.8.8 have a flaw where the login CAPTCHA challenge is stored in a signed client-side cookie. Attackers can reuse a solved CAPTCHA challenge by replaying the original signed cookie with incorrect access codes, allowing brute-force attempts to gain an administrator session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for repeated failed login attempts with the same CAPTCHA challenge. Check server logs for multiple access code submissions using the same signed cookie. Look for administrator session creation after multiple failed attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could bypass CAPTCHA protections and brute-force their way into an administrator account. This could lead to unauthorized access to sensitive data, manipulation of notes or files, and potential control over the SiYuan application and its APIs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable SiYuan versions may face compliance violations and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.9 or later. Implement server-side tracking of CAPTCHA challenges to invalidate them after use. Enforce rate limiting per IP or session. Bind CAPTCHA challenges to browser sessions and ensure they expire quickly.

Useful 0 Not Useful 0