SiYuan Authentication Bypass in FilterViewByPublishAccess

Executive Summary

This vulnerability affects SiYuan note-taking app versions before v3.7.4. It is an authentication bypass in the FilterViewByPublishAccess filter that fails to check password protection when rendering attribute views and database rows. Unauthenticated users can access password-protected document rows, including titles, block IDs, and column values, by calling renderAttributeView without supplying the required password.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before v3.7.4. Use commands like 'curl -s http://localhost:6806/version' or check the application's about section. If vulnerable, unauthenticated users may access password-protected rows via renderAttributeView without a password.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could access sensitive data in password-protected documents, such as titles, block IDs, and column values. This could lead to unauthorized disclosure of confidential information stored in SiYuan notes. The impact is limited to confidentiality since other tiers like hidden/forbidden are correctly enforced.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other privacy regulations that mandate strict access controls and data protection measures. Unauthorized disclosure of protected information may result in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later immediately. If upgrading is not possible, restrict network access to the SiYuan instance or disable publish mode until patched. Monitor logs for unauthorized access attempts to attribute views or database rows.

Useful 0 Not Useful 0