SiYuan Encrypted Notebook Publish API Access Bypass

Executive Summary

SiYuan before v3.7.4 fails to validate publish access for encrypted notebooks, treating them as publicly accessible by default. When unlocked, anonymous users can retrieve fully decrypted content via the publish API without authentication or encryption keys.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if SiYuan is running version 3.7.4 or later. Inspect network traffic for unauthorized access to the publish API, particularly requests targeting encrypted notebooks. Look for anomalies in access logs where anonymous users retrieve decrypted content without authentication.

Useful 0 Not Useful 0

Impact Analysis

If you use SiYuan with encrypted notebooks, attackers could access your decrypted documents while the notebook is unlocked. This exposes sensitive data without requiring privileges or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Full decryption of documents without authentication may result in non-compliance with data protection standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later to patch the vulnerability. Disable the publish feature for encrypted notebooks if not required. Review and restrict access to the publish API to prevent unauthorized enumeration of decrypted content.

Useful 0 Not Useful 0