SiYuan DOM Transformation Access Control Bypass

Executive Summary

SiYuan before v3.7.4 has an insufficient access control flaw in the /api/lute/spinBlockDOM endpoint. This endpoint is protected only by basic authentication checks instead of requiring admin privileges like its sibling endpoint. Authenticated users with lower roles (RoleEditor or RoleReader) can access and manipulate DOM input through this endpoint. Large payloads sent to this endpoint cause resource exhaustion due to per-path mutex serialization, leading to endpoint starvation.

Useful 0 Not Useful 0

Detection Guidance

Check if your SiYuan instance is running a version before 3.7.4. Inspect network traffic for requests to the /api/lute/spinBlockDOM endpoint from non-admin users. Monitor for unusually large payloads or delayed responses indicating resource starvation.

Useful 0 Not Useful 0

Impact Analysis

Unauthorized users with basic access can transform arbitrary DOM input, potentially modifying or extracting sensitive data. Large payloads sent to the endpoint can cause the system to slow down or crash, disrupting service for all users. This may lead to data leaks, service unavailability, or system instability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information (PHI) integrity and availability. Both standards require strict access controls and protection against unauthorized data exposure or service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later. Implement input size limits (e.g., 1MB) for the /api/lute/spinBlockDOM endpoint. Restrict access to admin-only roles by adding CheckAdminRole middleware to the endpoint.

Useful 0 Not Useful 0