SiYuan Authentication Bypass in Publish Mode

Executive Summary

SiYuan versions before v3.7.3 have an authentication bypass flaw in publish mode. Content-returning endpoints like getHeadingChildrenDOM and getBacklinkDoc do not check passwords even though the primary getDoc endpoint does. Attackers can access password-protected documents by first obtaining internal block IDs from reader-accessible endpoints and then using unprotected endpoints to retrieve full content without authentication.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan server logs for repeated calls to endpoints like getHeadingChildrenDOM, getHeading*Transaction, or getBacklinkDoc. Monitor for unauthorized access attempts to password-protected documents via these endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to read sensitive or confidential documents stored in SiYuan that are meant to be password-protected. Attackers could access private notes, sensitive data, or proprietary information without detection, leading to data breaches or leaks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other privacy regulations by exposing protected health information, personal data, or confidential records. Organizations using vulnerable SiYuan versions may face legal penalties, fines, or reputational damage due to unauthorized data access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version v3.7.3 or later to patch the authentication bypass. Temporarily restrict access to internal block IDs and review network traffic for suspicious endpoint calls.

Useful 0 Not Useful 0