SiYuan Admin Path Traversal in Bazaar Endpoints

Executive Summary

SiYuan before v3.7.4 has a path traversal vulnerability in its Bazaar install and uninstall endpoints. The packageName parameter is not properly validated, allowing authenticated administrators to use directory traversal sequences to write arbitrary files anywhere on the system during install or delete directories recursively during uninstall.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan version with 'siYuan --version' or inspect the application directory. Monitor logs for unusual file operations or deletions in system directories. Review Bazaar endpoints for requests containing '../' or similar traversal sequences in packageName parameters.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could delete critical system files or write malicious files to any location. This could disrupt SiYuan's operation, corrupt other users' data, or allow further attacks by replacing legitimate files with malicious ones.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion or modification, violating integrity and availability requirements in GDPR and HIPAA. It may result in data breaches if malicious files are written or sensitive data is exposed through improper file access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later immediately. Restrict admin access to SiYuan instances. Implement network monitoring for suspicious activity. Disable Bazaar endpoints if not required. Review and audit file system permissions for the SiYuan process.

Useful 0 Not Useful 0