Executive Summary

This vulnerability affects SiYuan, a personal knowledge management system, in versions from 3.6.0 to before 3.6.2. The issue lies in the SanitizeSVG function introduced in version 3.6.0 to fix cross-site scripting (XSS) in the unauthenticated /api/icon/getDynamicIcon endpoint. However, attackers can bypass this sanitization by using namespace-prefixed element names like <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the tag as "x:script" instead of "script", allowing the malicious tag to pass through the check. When the SVG is served with Content-Type: image/svg+xml and no Content Security Policy, a browser opening the response directly will resolve the prefix to the SVG namespace and execute the embedded script.

This vulnerability was patched in version 3.6.2.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to cross-site scripting (XSS) attacks via the unauthenticated /api/icon/getDynamicIcon endpoint. An attacker can inject malicious scripts that will be executed by a victim's browser when the SVG content is loaded. This can result in unauthorized actions, data theft, session hijacking, or other malicious activities performed in the context of the vulnerable application.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been patched in SiYuan version 3.6.2. The immediate step to mitigate this vulnerability is to upgrade SiYuan to version 3.6.2 or later.

Useful 0 Not Useful 0