SiYuan Path Traversal Vulnerability Allows File Access

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions prior to 3.7.1. The issue is in the /snippets/*filepath route handler, where the server joins a decoded request path with the snippets directory without properly checking for subpath containment or sensitive paths.

Because of this, an authenticated user can craft a request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to access files outside the intended snippets directory, including workspace secrets and the document database.

This vulnerability allows unauthorized reading of sensitive files by bypassing path restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information stored within the SiYuan system, such as workspace secrets and the document database.

An attacker with authenticated access could exploit this flaw to read confidential data that should be protected, potentially leading to data breaches or leakage of private information.

The CVSS score of 7.7 indicates a high severity impact, emphasizing the risk of confidentiality loss.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SiYuan to version 3.7.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user to read workspace secrets and the document database by exploiting a path traversal issue. Such unauthorized access to sensitive data could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Specifically, the exposure of workspace secrets and document databases may result in breaches of confidentiality and data integrity requirements mandated by these standards, potentially causing non-compliance and legal consequences.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access sensitive files via the vulnerable `/snippets/*filepath` route using path traversal sequences in the URL. Since the flaw allows authenticated users to bypass path restrictions, you can test by sending authenticated HTTP GET requests with encoded traversal paths.

• Use curl or similar tools to send requests like: `curl -i -H "Authorization: Bearer <token>" "http://<target>/snippets/%2e%2e/%2e%2e/conf/conf.json"` to check if the configuration file is accessible.
• Similarly, test access to the database file with: `curl -i -H "Authorization: Bearer <token>" "http://<target>/snippets/%2e%2e/%2e%2e/temp/siyuan.db"`.

If these requests return the contents of the files, it indicates the presence of the path traversal vulnerability.

Useful 0 Not Useful 0