Template Injection in SiYuan Prior to 3.7.0

Compliance Impact

This vulnerability allows an unauthenticated attacker to exfiltrate all user note content, tags, asset references, and block attributes from the SiYuan SQLite database. Such unauthorized access to personal and potentially sensitive data could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and health-related information.

Because the vulnerability enables data exfiltration without authentication, it undermines confidentiality requirements mandated by these standards, potentially resulting in non-compliance and associated legal or regulatory consequences.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for unauthenticated requests to the `/api/icon/getDynamicIcon` endpoint with the parameter `type=8` and a valid block ID. Such requests indicate attempts to exploit the template injection flaw to execute arbitrary SQL queries against the SiYuan SQLite database.

To detect exploitation attempts, you can use network monitoring tools or web server logs to search for HTTP requests matching the following pattern:

• GET /api/icon/getDynamicIcon?type=8&blockId=<valid_block_id>

Example commands to detect such requests include:

• Using grep on web server logs: `grep "/api/icon/getDynamicIcon?type=8" /path/to/access.log`
• Using tcpdump to capture HTTP traffic on port 80 or 443 and filter for the endpoint: `tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep "/api/icon/getDynamicIcon?type=8"`

Additionally, verifying the SiYuan version running on your system is important, as versions prior to 3.7.0 are vulnerable. Upgrading to version 3.7.0 or later mitigates this issue.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in SiYuan, an open-source personal knowledge management system, prior to version 3.7.0. The /api/icon/getDynamicIcon endpoint is excluded from authentication, allowing unauthenticated access. When this endpoint is called with type=8 and a valid block ID, it executes a Go template that runs arbitrary SELECT SQL queries against the SiYuan SQLite database. This enables an unauthenticated attacker who knows a valid block ID to extract all user note content, tags, asset references, and block attributes from the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated, network-adjacent attacker to exfiltrate sensitive data stored in the SiYuan database, including all user notes, tags, asset references, and block attributes. This can lead to significant data leakage and privacy breaches, potentially exposing confidential or personal information without requiring any authentication.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in SiYuan version 3.7.0. Immediate mitigation involves upgrading SiYuan to version 3.7.0 or later.

Useful 0 Not Useful 0