SiYuan Note authFilePublishAccess Authentication Bypass Leads to Information Disclosure

Vulnerability Overview The function fails to distinguish between hidden/blocked documents and public/non-existent documents. Consequently, it issues a cookie for documents it reports as blocked. Scope of Impact Affected Versions: at and . Severity: Medium (5.8 / 10). CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: None - Availability: None Remediation Recommended Fixes: - Return identical responses for every failed attempt and for any tier where the caller lacks access, omitting the header and avoiding differentiated error messages. - Specifically, do not treat an empty storage password as a successful match; hidden and blocked entries should short-circuit based on their own access requirements rather than checking their own passwords. - Encrypted notebook branches should return the same generic response regardless of other entries. - Implementing rate limiting on this endpoint is a reasonable additional hardening measure, although it does not address the information disclosure issue described above. POC Code Details Route: Handler: on the dev branch, on the master branch. is never assigned in the failure path, so every response carries . Three distinct result scenarios (Note: The original text lists five, but groups them logically): - Public (no publish access entry): missing, is - Non-existent identifier: missing, is - Password protected: missing, is - Hidden: present, is - Blocked: present, is Proof of Concept With Publish Mode Enabled ( set to ) and an anonymous client, requests are made for candidate identifiers, all with an empty password: By comparing the response message and the presence of the header, identifiers can be categorized according to the table above. Hidden and blocked entries return a cookie and an empty message, allowing an attacker to distinguish them from public documents or completely invalid identifiers. Impact Anonymous readers or any publisher with privileges can classify arbitrary document identifiers by access tier and confirm the existence of documents within hidden and blocked layers. On the dev branch, each endpoint additionally reveals whether an identifier belongs to an encrypted notebook. Specifically, no document content is leaked, nor are privileges gained, as the published cookies are inserted for these layers. The value lies in acting as a confirmation primitive that converts identifiers obtained elsewhere into explicit statements about documents that the reader is not permitted to view. This affects Confidentiality only; Integrity and Availability are not impacted.

Goal Reached Thanks to every supporter — we hit 100%!

SiYuan Note authFilePublishAccess Authentication Bypass Leads to Information Disclosure

More from this source