Path Traversal in SiYuan Knowledge Base

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions prior to 3.7.1. The POST /api/file/globalCopyFiles endpoint accepts attacker-supplied absolute source paths and relies on a denylist function (util.IsSensitivePath) that fails to block common home-directory credential files such as .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg.

Because of this incomplete denylist, an authenticated administrator or API-token user can copy these sensitive credential files into the workspace and exfiltrate them through the file API.

This issue was fixed in versions 3.7.1-alpha.2 and 3.7.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the unauthorized disclosure of sensitive credential files stored in users' home directories.

An attacker with authenticated administrator or API-token access can copy and exfiltrate files such as .git-credentials, .netrc, and other configuration files that may contain passwords, tokens, or keys.

This exposure can compromise the security of connected services, lead to unauthorized access, and potentially result in further attacks or data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade SiYuan to version 3.7.1-alpha.2 or 3.7.1, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated administrator or API-token user to copy sensitive credential files from the system into the workspace and potentially exfiltrate them through the file API.

Exfiltration of sensitive credential files could lead to unauthorized access to personal or protected data, which may impact compliance with data protection regulations such as GDPR and HIPAA that require safeguarding sensitive information.

However, the provided information does not explicitly describe the direct impact on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the ability of an authenticated administrator or API-token user to copy sensitive credential files from the home directory into the workspace via the POST /api/file/globalCopyFiles endpoint. Detection can focus on monitoring API usage and file access patterns related to this endpoint.

To detect exploitation attempts, you can monitor HTTP POST requests to /api/file/globalCopyFiles that include absolute paths pointing to sensitive files such as .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, or .gnupg files.

Suggested commands for detection include:

• Use network monitoring tools (e.g., tcpdump, Wireshark) to filter HTTP POST requests to the vulnerable endpoint:
• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/api/file/globalCopyFiles'
• Search application logs for POST requests to /api/file/globalCopyFiles containing suspicious absolute paths:
• grep -E 'POST /api/file/globalCopyFiles' /path/to/siyuan/logs/* | grep -E '\.git-credentials|\.netrc|\.pgpass|\.kube/config|\.docker/config.json|\.gnupg'
• Check for copied sensitive files in the workspace directory by listing recently modified files matching known credential filenames.
• find /path/to/workspace -type f \( -name '.git-credentials' -o -name '.netrc' -o -name '.pgpass' -o -path '*/.kube/config' -o -name 'config.json' -o -path '*/.gnupg/*' \) -mtime -7

These detection methods rely on monitoring API usage patterns and file system changes related to the vulnerability.

Useful 0 Not Useful 0