DOM XSS in SiYuan Personal Knowledge Management System

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions prior to 3.7.0. The issue arises because untrusted fields such as name, version, author, and description are not properly escaped when serialized into the data-obj HTML attribute of each marketplace card.

The data-obj attribute is single-quoted, and the value is produced using JSON.stringify(), which does not escape certain characters like single quotes, less than, or greater than signs. If a package name contains a single quote, it can break out of the attribute and inject arbitrary HTML.

In the desktop client, the main BrowserWindow runs with nodeIntegration enabled and contextIsolation disabled, which allows this injected markup to escalate from a DOM-based cross-site scripting (XSS) vulnerability to arbitrary operating system command execution.

This vulnerability was fixed in version 3.7.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to inject arbitrary HTML and escalate that to arbitrary OS command execution on the affected system.

An attacker could exploit this to execute malicious commands on the user's operating system, potentially leading to full system compromise, data theft, or other malicious activities.

The CVSS v3.1 base score of 9.0 reflects the high severity, indicating network attack vector, low attack complexity, requiring privileges and user interaction, but with scope change and high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in SiYuan version 3.7.0. The immediate step to mitigate this vulnerability is to upgrade the SiYuan personal knowledge management system to version 3.7.0 or later.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the marketplace cards in the SiYuan application for unescaped single quotes in the data-obj HTML attribute. Since the vulnerability involves injection of arbitrary HTML via package fields such as name, author, or version containing single quotes, you can look for suspicious or malformed data-obj attributes in the marketplace UI.

There are no specific network detection commands provided, but detection can involve checking the installed SiYuan version to confirm if it is prior to 3.7.0, as the vulnerability is fixed in version 3.7.0.

For system inspection, you can check the version of SiYuan installed by running commands like:

• On Linux/macOS: `siyuan --version` or check the application about page.
• On Windows: Check the version in the application UI or via installed programs list.

To detect exploitation attempts, monitor for unexpected HTML injection or unusual OS command executions triggered by the Electron client, but no specific commands are provided in the resources.

Useful 0 Not Useful 0