SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.
SiYuan, a personal knowledge management system, is vulnerable to a critical path traversal attack. This allows attackers to read arbitrary files, potentially exposing sensitive secrets like API tokens and authentication keys, leading to administrative access and the potential for remote code execution (RCE). Successful exploitation grants complete control over the application and potentially the underlying server.
Step 1: Craft Malicious Request: The attacker crafts a HTTP GET request targeting the /export endpoint. The request includes a crafted payload in the file path parameter, designed to traverse the file system. The payload utilizes double-encoded path traversal sequences (e.g., %252e%252e%252f).
Step 2: Payload Delivery: The crafted request is sent to the vulnerable SiYuan server.
Step 3: Endpoint Processing: The /export endpoint receives the request and attempts to process the file path provided in the request. Due to the lack of proper input validation, the double-encoded traversal sequences are not correctly sanitized.
Step 4: File System Traversal: The application interprets the malicious file path, allowing it to move up the directory structure using the ../ sequences.
Step 5: Sensitive File Access: The attacker uses the traversal to navigate to the desired sensitive file, such as conf/conf.json.
Step 6: Information Disclosure: The contents of the sensitive file (e.g., API token, cookie signing key) are read and returned in the response, enabling the attacker to gain administrative access.
The vulnerability stems from insufficient input validation in the /export endpoint of the SiYuan application. The endpoint fails to properly sanitize user-supplied input used to construct file paths. Specifically, the application does not adequately handle double-encoded path traversal sequences (e.g., %252e%252e%252f). This allows an attacker to craft a malicious request that navigates outside the intended directory, enabling access to sensitive configuration files like conf/conf.json. The root cause is a lack of robust input sanitization and path normalization before file access operations. The application trusts user-supplied input without proper validation, leading to the path traversal.