Stored XSS in SiYuan Knowledge Management System

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, prior to version 3.7.0. The issue is in how the system renders Bazaar package README files from Markdown to HTML using the lute engine with a sanitizer that only blocks a fixed list of legacy event handler attributes. Modern event handlers like onpointerover, onpointerdown, and others are not blocked and are passed through verbatim.

Because the frontend assigns this rendered HTML directly to an element's innerHTML without additional client-side sanitization or security headers, a malicious third-party Bazaar package author can inject JavaScript event handlers. When an Administrator views and interacts with the package listing, this JavaScript runs with the Administrator's authenticated privileges, allowing full control over the workspace.

This vulnerability is fixed in version 3.7.0.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a third-party Bazaar package author to execute arbitrary JavaScript code within the context of an authenticated Administrator's session in SiYuan.

This can lead to full compromise of the Administrator's workspace, including unauthorized access, modification, or deletion of data managed by SiYuan.

Because the attack requires the Administrator to view and interact with the malicious package listing, it involves user interaction but can result in high impact due to the elevated privileges.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SiYuan to version 3.7.0 or later, where the issue is fixed.

Avoid opening Bazaar package READMEs in the Settings → Marketplace section until the upgrade is applied, especially as an Administrator.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a malicious package author to execute JavaScript in the administrator's authenticated session, potentially leading to full control of the workspace and theft of sensitive information such as the kernel API token.

Such unauthorized access and control can result in breaches of confidentiality and integrity of data, which may violate compliance requirements under common standards and regulations like GDPR and HIPAA that mandate protection of sensitive data and prevention of unauthorized access.

The lack of security measures such as proper sanitization and Content-Security-Policy headers increases the risk of data exposure and unauthorized actions, thereby negatively impacting compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious JavaScript injected via event handlers in the README files of Bazaar packages rendered in the SiYuan application. Detection involves inspecting the rendered README HTML for the presence of modern event handler attributes that bypass the sanitizer, such as onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, and ontransitionend.

To detect potential exploitation or presence of this vulnerability on your system, you can search for these event handler attributes in the README files or in the HTML content served by the SiYuan application.

• Use command-line tools like grep to scan README files or rendered HTML for suspicious event handlers, for example:
• grep -E 'onpointerover|onpointerdown|onauxclick|onbeforetoggle|onfocusin|onanimationstart|ontransitionend' path/to/bazaar/readme/files/*.md
• If you have access to the running application or its HTTP responses, you can capture and inspect the HTML content for these event handlers using tools like curl and grep:
• curl -s http://your-siyuan-instance/path/to/package/readme | grep -E 'onpointerover|onpointerdown|onauxclick|onbeforetoggle|onfocusin|onanimationstart|ontransitionend'

Additionally, monitoring for unexpected JavaScript execution or unusual administrator interactions with the Bazaar marketplace README pages may help detect exploitation attempts.

Useful 0 Not Useful 0