SiYuan Kernel Origin Trust Misconfiguration

Compliance Impact

This vulnerability allows any Chrome/Chromium extension to gain RoleAdministrator access to the SiYuan kernel HTTP server without authentication, enabling data exfiltration, stored XSS injection, and configuration tampering.

Such unauthorized access and potential data exfiltration could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

Therefore, exploitation of this vulnerability may compromise compliance with these common standards and regulations by exposing sensitive data and failing to maintain adequate access controls.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, prior to version 3.7.0. The kernel HTTP server in SiYuan Note unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication.

Because the default AccessAuthCode is empty on desktop installs, any Chrome or Chromium extension—including a compromised legitimate extension via a supply chain attack—can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806.

This allows attackers to perform actions such as data exfiltration, stored cross-site scripting (XSS) injection, and configuration tampering.

The vulnerability was fixed in version 3.7.0.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized admin API access to the SiYuan kernel HTTP server at 127.0.0.1:6806 from any Chrome/Chromium extension due to an overly permissive origin allowlist.

To detect exploitation attempts or presence of this vulnerability on your system, you can monitor local network traffic for suspicious API calls to the SiYuan kernel on port 6806, especially requests originating from chrome-extension:// origins.

• Use netstat or ss to check if the SiYuan kernel HTTP server is listening on port 6806: `netstat -an | grep 6806` or `ss -an | grep 6806`.
• Use a local packet capture tool like tcpdump or Wireshark to monitor HTTP requests to 127.0.0.1:6806 and filter for requests with the Origin header containing "chrome-extension://".
• Example tcpdump command: `tcpdump -i lo -A port 6806 | grep 'Origin: chrome-extension://'`
• Check SiYuan application logs for unexpected admin API calls or configuration changes that could indicate exploitation.
• Audit installed Chrome/Chromium extensions for suspicious or unknown extensions that could exploit this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized administrative access to the SiYuan kernel via any installed Chrome or Chromium extension.

An attacker could exfiltrate sensitive data stored in SiYuan, inject malicious scripts through stored XSS attacks, and tamper with the application's configuration.

Such actions could compromise the confidentiality, integrity, and availability of your data and system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SiYuan Note to version 3.7.0 or later, where the issue is fixed.

Additionally, avoid running untrusted Chrome/Chromium extensions, as any installed extension can gain administrator access due to the vulnerability.

Consider configuring AccessAuthCode to a non-empty value to prevent unauthenticated access.

Useful 0 Not Useful 0