Information Disclosure in SiYuan via Unauthorized Outline Storage Access

Executive Summary

SiYuan versions before v3.7.4 have an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint. This endpoint lacks authorization checks, allowing attackers to retrieve outline state including heading identifiers for any document by providing its identifier, even for documents they are not authorized to access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before v3.7.4. You can verify the version by inspecting the application settings or logs. Additionally, monitor network traffic for requests to the /api/storage/getOutlineStorage endpoint with document identifiers. Unauthorized access attempts or responses containing heading identifiers may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

Attackers could access outline states of restricted documents, revealing heading identifiers and whether an administrator interacted with them. This exposes document structure and metadata without requiring authentication beyond basic access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive document metadata. Unauthorized access to document structure may compromise confidentiality requirements, especially for restricted or sensitive content.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SiYuan to version v3.7.4 or later to patch the vulnerability. If an update is not immediately available, restrict access to the /api/storage/getOutlineStorage endpoint by implementing proper authorization checks. Ensure all users have the least privileges required for their roles.

Useful 0 Not Useful 0