Incomplete Fix for Sensitive Path Bypass in SiYuan Note (GHSA-c8r8-95hq-mp34)

Vulnerability Key Information Summary Vulnerability Overview Title: Incomplete Fix for GHSA-c8r8-95hq-mp34: Recursive MCP File Operations Bypass Sensitive Path Protection Vulnerability Type: Sensitive Path Protection Bypass (Recursive MCP file operations bypass) CVSS Score: 6.5 / 10 (Medium) Core Issue: The fix for (commit ) only checked the final path but failed to check intermediate paths traversed during recursive operations (such as , , ). Attackers can leverage recursive file operations to access protected sensitive files (e.g., ) by using allowed paths as an entry point. Affected Components: : Can return matching lines from non-hidden protected descendant files. : Can copy protected descendant files to standard directories. : Can overwrite protected descendant files via ZIP member name inclusion. Impact Scope Affected Versions: Fixed Version: Affected Package: Primary CWE: CWE-683 (Incorrect Authorization) Secondary CWE: CWE-200 (Information Exposure to an Unauthorized Actor) Specific Impact: Confidentiality leak of protected configuration files (selective disclosure). Full recovery possible via the attack vector. may contain workspace access credentials, API Tokens, or Cookie signature keys. Integrity compromise of protected configuration files (overwriting). Includes workspace configurations, publication access rules, snapshot registries, templates, and notebook metadata. Remediation Suggested Fix: 1. Add an operation-aware final path authorization helper function that is called before every file creation, enforcing workspace inclusion, encrypted notebook rules, symlink policies, and . 2. Copy or wrap to use guarded walking, validating each candidate file before copying and safely skipping denied paths instead of returning errors. 3. Pre-populate the full tree, checking whether each source and final target is denied before opening files, thereby avoiding partial reads and writes. 4. Enumerate and normalize archive output members, preserving internal inclusion checks, rejecting symlinks/special entries, validating each final output path, and placing all member prefixes in a staging directory to prevent partial overwrites. 5. Add regression tests: Direct denial, parent-level recursion denial, hidden directory skipping, safe sibling success, directory/symlink denial, malicious member denial, and benign archive success. 6. As an untested defense-in-depth measure, make deletion/renaming aware of ancestors and deny list-based behaviors. 7. Add operation audit logs before sensitive file operations, relying only on shared operation strings. POC/Exploit Code Complete POC code or exploit code is not included in the page. Only relevant technical details and test assertions are mentioned: Confirmed Assertions: 1. Direct on denies the path. 2. Recursive on the root within returns all sensitive tokens. 3. Directory copy from succeeds; the copied archive is readable. 4. Recursive grep on standard data paths succeeds as a negative control. 5. Direct parsing and simulated per-member prefix checks deny protected archive members. 6. Unmodified overwrites protected files regardless. 7. Unmodified archive extraction functions normally as a negative control. 8. Permission registration test refactored real capability paths, validating registration and paths via and . Related Code Snippets (Technical Details Section):

Goal Reached Thanks to every supporter — we hit 100%!

Incomplete Fix for Sensitive Path Bypass in SiYuan Note (GHSA-c8r8-95hq-mp34)

More from this source