Executive Summary

A sensitive-path denylist bypass vulnerability was discovered in SiYuan 3.5.4 before 3.8.7 on Windows. This vulnerability allows authenticated API callers to copy sensitive workspace configuration files into assets served to unauthenticated clients. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity.

Technical Analysis

The vulnerability is caused by the way SiYuan handles file paths on Windows. Specifically, the IsSensitivePath function fails to properly handle the Windows extended-length prefix (\?\), which allows an attacker to bypass the sensitive-path denylist. An attacker can exploit this vulnerability by prepending the \?\) prefix to the localPath parameter in the /api/import/importStdMd API endpoint. This allows the attacker to copy sensitive workspace configuration files, including the API token and TLS private keys, into assets served to unauthenticated clients.

How It Gets Exploited

An authenticated API caller can exploit this vulnerability by sending a crafted request to the /api/import/importStdMd endpoint with the localPath parameter prepended with the \?\) prefix. For example, an attacker could send a request with the following localPath parameter: \?\)C:/path o ile. The IsSensitivePath function would fail to properly handle this prefix, allowing the attacker to copy sensitive files into assets served to unauthenticated clients. The attacker would then be able to access these sensitive files, potentially leading to further exploitation.

Impact Assessment

The impact of this vulnerability is significant, as it allows an attacker to access sensitive workspace configuration files, including API tokens and TLS private keys. This could lead to further exploitation, such as unauthorized access to sensitive data or systems. The vulnerability affects SiYuan versions 3.5.4 before 3.8.7 on Windows.

Recommended Actions

To mitigate this vulnerability, users should update SiYuan to version 3.8.7 or later. Additionally, users should ensure that sensitive configuration files are properly protected and that API tokens and TLS private keys are securely stored. Users should also monitor their SiYuan instances for suspicious activity and implement additional security measures, such as authentication and authorization controls, to prevent unauthorized access.