Path Traversal in SiYuan via Double URL Encoding

Compliance Impact

This vulnerability allows an unauthenticated remote attacker to read arbitrary files inside the WorkspaceDir, including configuration files containing sensitive information such as AccessAuthCode SHA256 hash, API tokens, and sync keys.

Exposure of such sensitive data could lead to unauthorized access and data breaches, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

However, the provided information does not explicitly describe the direct impact on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated remote attacker exploiting double URL encoding to read arbitrary files via the /assets/*path route on the default port 6808 in SiYuan versions prior to 3.7.0.

To detect if your system is vulnerable, you can attempt to access sensitive files by sending HTTP requests with double URL encoded path traversal sequences to the /assets/ endpoint on port 6808.

For example, you can use curl commands to test for the vulnerability by trying to read the conf/conf.json file:

• curl -v "http://<target-ip>:6808/assets/%252e%252e/%252e%252e/conf/conf.json"
• curl -v "http://<target-ip>:6808/assets/%252e%252e/%252e%252e/temp/siyuan.db"

If the response contains the contents of these files, your system is vulnerable.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, prior to version 3.7.0. It involves a path traversal issue via double URL encoding in the /assets/*path route. Although a previous patch fixed a similar issue in the /export/ route, the same root cause remained in the /assets/*path route. An unauthenticated remote attacker can exploit this by double-URL-encoding ".." segments to read arbitrary files inside the WorkspaceDir.

• The attacker can access sensitive files such as conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log.

This vulnerability is exploitable in publish mode, which is an anonymous read-only HTTP endpoint running on the default port 6808. The issue was fixed in version 3.7.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to read arbitrary files within the WorkspaceDir of the SiYuan system. This can lead to exposure of sensitive information such as authentication tokens, API keys, sync keys, and database files.

• Unauthorized disclosure of confidential data including AccessAuthCode SHA256 hash, API tokens, and synchronization keys.
• Potential compromise of user data stored in the database files (temp/siyuan.db, temp/blocktree.db).
• Exposure of system logs (siyuan.log) which might contain sensitive operational information.

Overall, this can lead to loss of confidentiality and may facilitate further attacks or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade SiYuan to version 3.7.0 or later, as this version includes the fix for the path traversal issue in the /assets/*path route.

Until the upgrade is applied, consider restricting access to the publish mode HTTP endpoint (default port 6808) to trusted networks or users to prevent unauthenticated remote attackers from exploiting the vulnerability.

Useful 0 Not Useful 0