SiYuan Asset File Stored XSS via Missing Headers

Executive Summary

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets. This allows stored cross-site scripting attacks where authenticated attackers can upload HTML files as assets. When the workspace owner opens the asset link, the script executes with full kernel API access.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan versions for affected releases (<=3.7.3). Inspect network traffic for requests to /assets/*path endpoints serving HTML files without proper headers. Look for uploaded HTML/HTM files in the assets directory. Monitor for unexpected script execution or unauthorized API calls from the kernel.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload a malicious HTML file as an asset. If you open the asset link, the script runs with full access to your SiYuan workspace, including reading/writing notebooks, performing admin actions, and accessing credentials. This requires you to be authenticated and the attacker to have access to upload files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized modifications, or exposure of personal or health information, requiring breach notifications and potential fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later immediately. Block or restrict access to the /assets/*path endpoint. Implement strict file upload policies to prevent HTML/HTM file uploads. Add Content-Disposition and X-Content-Type-Options headers for all asset responses.

Useful 0 Not Useful 0