Stored XSS in SiYuan Knowledge Management System

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, prior to version 3.7.0. The issue is in the attribute-view (database) cell renderer called genAVValueHTML, which improperly interpolates raw cell content in four branches: text, url, phone, and mAsset. Malicious cell values containing crafted HTML and JavaScript, such as closing tags followed by an image tag with an onerror event, can break out of their intended context and execute arbitrary JavaScript when a user opens the block-attribute panel.

On the Electron desktop version, the renderer runs with nodeIntegration enabled, allowing the cross-site scripting (XSS) attack to escalate to remote code execution (RCE) by using Node.js modules like 'child_process'. Since attribute-view files are synced across devices, an attacker with write access to any synced workspace can plant a payload that executes on every device opening the affected panel. The vulnerability persists because the malicious cell content is not escaped or sanitized properly.

This vulnerability was fixed in version 3.7.0 of SiYuan.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including the execution of arbitrary JavaScript code within the application context when a user opens a block-attribute panel containing the malicious cell.

On Electron desktop versions, this can escalate to remote code execution (RCE) on the host system due to nodeIntegration being enabled, allowing attackers to run system commands via Node.js modules.

Because the malicious payload can be synced across devices through the workspace files, an attacker with write access to any synced workspace can compromise all devices that open the affected panel, leading to widespread compromise.

Overall, this can lead to full system compromise, data theft, unauthorized actions, and loss of integrity and availability of your data and system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SiYuan to version 3.7.0 or later, where the issue is fixed.

Additionally, restrict write access to synced workspaces to prevent attackers from planting malicious payloads.

Be cautious when opening block-attribute panels containing data from untrusted sources, as the vulnerability allows arbitrary JavaScript execution leading to remote code execution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to full system compromise. Such a compromise can result in unauthorized access, modification, or destruction of sensitive data.

Because of the high impact on confidentiality, integrity, and availability, organizations using affected versions of SiYuan may face challenges in maintaining compliance with standards like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Exploitation of this vulnerability could lead to data breaches or loss of data integrity, which are reportable incidents under these regulations, potentially resulting in legal and financial consequences.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the attribute-view (database) cell content files for malicious payloads that include HTML tags breaking out of their context, such as payloads containing strings like '</textarea><img src=x onerror="...">' or '"><img src=x onerror="...">'. These payloads are stored persistently in files under the workspace directory, specifically in data/storage/av/<avID>.json.

To detect such payloads on your system, you can search for suspicious patterns in the attribute-view JSON files using command-line tools like grep.

• grep -rE '</textarea><img src=x onerror="|"><img src=x onerror="' path/to/workspace/data/storage/av/
• grep -rE '<img src=x onerror=' path/to/workspace/data/storage/av/

Additionally, monitoring network traffic for unusual sync activity or unexpected file changes in the workspace directory may help detect exploitation attempts, especially in environments using shared filesystems or sync services.

Useful 0 Not Useful 0