SiYuan Cross-Site WebSocket Hijacking Before 3.7.4

Executive Summary

CVE-2026-74802 is a cross-site WebSocket hijacking vulnerability in SiYuan versions before 3.7.4. The /ws/network/proxy endpoint disables origin validation by setting CheckOrigin to always return true, allowing attackers to establish WebSocket connections from malicious webpages. This lets them direct the SiYuan kernel to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized WebSocket connections to the /ws/network/proxy endpoint in SiYuan versions before 3.7.4. Check logs for WebSocket handshake requests with missing or invalid Origin headers. Use tools like Wireshark or tcpdump to capture WebSocket traffic and inspect for connections originating from unexpected sources.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick a user with an active admin session into visiting a malicious webpage. This would allow the attacker to proxy arbitrary network traffic through the victim's machine, potentially accessing internal systems or sensitive data. The impact depends on the victim's network configuration and permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. It may also enable lateral movement within networks, compromising integrity and availability. Organizations using affected SiYuan versions should assess their compliance posture and apply mitigations promptly.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later if available. If no patch exists, disable the /ws/network/proxy endpoint or restrict access to trusted admin users only. Implement proper origin validation for WebSocket connections by removing the CheckOrigin override. Audit other WebSocket endpoints using the gws library for similar issues.

Useful 0 Not Useful 0