SiYuan Prior to 3.7.1 Information Disclosure via Storage Endpoint

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions prior to 3.7.1. The /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without applying the publish-access filtering that other similar storage endpoints use. As a result, a user with publish-mode Reader permissions can access private document paths, notebook, document, and block IDs, as well as search and replace keywords for unpublished documents.

This issue was fixed in version 3.7.1.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a publish-mode Reader to access private document paths, notebook, document, and block IDs, as well as search and replace keywords for unpublished documents without proper access filtering.

Such unauthorized access to private and potentially sensitive information could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SiYuan to version 3.7.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a user with limited publish-mode Reader permissions to access sensitive information that should be private, including private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents.

This unauthorized access can lead to information disclosure, potentially exposing confidential or unpublished content to unauthorized users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing access to the /api/storage/getCriteria endpoint in SiYuan versions prior to 3.7.1. Specifically, you can attempt to access this endpoint as a user with publish-mode Reader privileges and check if it returns saved search criteria including private document paths, notebook/document/block IDs, or search and replace keywords that should be restricted.

A practical approach is to send an HTTP GET request to the vulnerable endpoint and analyze the response for sensitive data leakage.

• Use curl to send a request to the endpoint: curl -X GET "http://<siyuan-server>/api/storage/getCriteria" -H "Authorization: Bearer <publish-mode-reader-token>"
• Inspect the response for any private or unpublished document paths, notebook IDs, or search/replace keywords that should not be accessible.

If the response contains such sensitive information, the system is vulnerable.

Useful 0 Not Useful 0