SiYuan Path Disclosure via resolveAssetPath Endpoint

Executive Summary

SiYuan versions before v3.7.4 have an information disclosure vulnerability in the resolveAssetPath endpoint. Attackers can submit relative asset paths from published documents to this endpoint to obtain the server's absolute workspace path. This reveals sensitive system details like the operating-system username and installation layout.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SiYuan instance (versions before 3.7.4) exposes absolute filesystem paths via the resolveAssetPath endpoint. Test by sending a request with a relative asset path from a published document to see if it returns an absolute path. Example using curl: curl -X POST http://<target>:<port>/resolveAssetPath -H 'Content-Type: application/json' -d '{"path": "relative/path/to/asset"}'

Also verify if related endpoints like getMissingAssets or getUnusedAssets return workspace-wide asset inventories without proper scoping. Use similar curl commands to query these endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gather sensitive system information such as the absolute filesystem path and OS username. This could be used to plan further attacks, like unauthorized access or data exfiltration, especially if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive system information and user data. Exposure of filesystem paths and usernames could lead to non-compliance with GDPR (data protection) and HIPAA (privacy and security rules), potentially resulting in legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later to patch the vulnerability. If upgrading is not possible, apply input validation to the resolveAssetPath endpoint to redact absolute paths and restrict access to authenticated users only.

Ensure publish mode has authentication enabled and scope related endpoints like getMissingAssets and getUnusedAssets to publish-access restrictions to prevent unauthorized access to sensitive paths.

Useful 0 Not Useful 0