SiYuan Publish Service Authentication Bypass via Session Cookie Replay

Executive Summary

SiYuan before v3.8.4 has an authentication bypass flaw in its publish service. Session cookies are sent without Secure or SameSite attributes over plaintext HTTP. An attacker can intercept a valid session cookie during Basic Auth and replay it to access authenticated endpoints without the account password.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for plaintext HTTP sessions involving SiYuan's publish service. Look for session cookies named publish-visitor-session-id transmitted without Secure or SameSite attributes. Use tools like Wireshark or tcpdump to capture traffic and inspect cookies in Basic Auth exchanges.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to your SiYuan publish account, exposing sensitive data or performing actions under your identity. The impact is limited to the privileges of the compromised publish account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements for protecting sensitive data in transit (e.g., GDPR Article 32, HIPAA Security Rule). Cleartext transmission of session cookies risks unauthorized access to personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later to apply the patch. Ensure TLS is enforced for all publish service traffic. Configure session cookies with Secure and SameSite attributes. Invalidate all existing session cookies to prevent replay attacks.

Useful 0 Not Useful 0