Mitigation Strategies

The vulnerability is fixed in SiYuan version 3.6.4. Therefore, the immediate step to mitigate this vulnerability is to upgrade the SiYuan personal knowledge management system to version 3.6.4 or later.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in SiYuan, a personal knowledge management system, prior to version 3.6.4. SiYuan configures Mermaid.js with securityLevel set to "loose" and htmlLabels enabled. In this configuration, <img> tags with src attributes are not properly sanitized and end up inside SVG <foreignObject> blocks. The SVG content is then injected into the application using innerHTML without any additional sanitization.

When a user opens a note containing a malicious Mermaid diagram, the Electron client fetches the image URL. On Windows systems, if the URL is protocol-relative (e.g., //attacker.com/image.png), it is interpreted as a UNC path (\\attacker.com\image.png). Windows then attempts to authenticate to this SMB path automatically, sending the victim's NTLMv2 hash to the attacker.

This behavior can lead to credential leakage to an attacker-controlled server. The vulnerability was fixed in SiYuan version 3.6.4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the leakage of NTLMv2 hashes from a victim's Windows machine to an attacker. Specifically, when a user opens a malicious note containing a crafted Mermaid diagram, their system may automatically send authentication hashes to an attacker-controlled SMB server.

An attacker who obtains these hashes could attempt to use them to authenticate or perform further attacks on the victim's network or systems, potentially leading to unauthorized access or lateral movement within an organization.

Useful 0 Not Useful 0