Listen to this Post
CVE-2026-72801 affects SiYuan’s publish mode.
Two CheckAuth-only endpoints, /api/system/getConf and /api/notebook/getNotebookConf, expose sensitive cryptographic material to unauthenticated remote clients when Publish.Auth.Enable is false, or to any RoleReader.
The getConf endpoint returns the full NotebookCrypto structure, including MasterSalt (Argon2id salt), KDFParams (memory/time/parallelism costs), KEKVerifier (AES-GCM encrypted magic), VerifierNonce, and KEKMAC (HMAC-SHA256 of the KEK).
These fields provide a complete offline password verification oracle.
An attacker can test candidate master passwords locally without any server interaction, bypassing rate limiting, lockout, and logging.
The work is fully GPU-parallelizable.
The getNotebookConf endpoint returns BoxCrypt.WrappedDEK and WrapNonce, the per‑notebook data‑encryption key wrapped under the KEK.
Once the master password is recovered, the attacker derives the KEK, decrypts WrappedDEK, and can decrypt all .sy files in that notebook.
This turns the at‑rest threat model into a remote pre‑authentication cracking opportunity.
The vulnerability exists because HideConfSecret() nulls many secret fields but omits NotebookCrypto; FilterConfByPublishIgnore() only touches UILayout.
lsNotebooks filters visibility, but getNotebookConf and getNotebookInfo do not apply reader filters.
The code is verified at origin/master (eef105683) with all routes registered as CheckAuth without CheckAdminRole.
A proof of concept involves two curl requests to retrieve the material, then offline cracking with tools like hashcat.
The impact is severe: confidentiality of all encrypted notebooks depends solely on master password entropy against offline attackers.
The suggested fix is to strip NotebookCrypto to only an enabled flag for non‑admins and to filter BoxCrypt fields for readers.
An unauthenticated attacker can obtain everything needed for an unlimited, unthrottled GPU‑parallel offline attack.
No server‑side rate limiting or logging occurs because the guessing phase is entirely off‑server.
The issue is present in both anonymous and RoleReader‑authenticated sessions when publish mode is enabled.
Affected endpoints: POST /api/system/getConf and POST /api/notebook/getNotebookConf (also getNotebookInfo).
The leak includes the global salt, KDF parameters, verifier, MAC, and wrapped per‑notebook key.
Recovering the master password allows decryption of all notebook data without further interaction.
This is a classic case of exposing offline cracking materials to remote unauthenticated users.
The vendor has been notified and a patch is expected.
DailyCVE Form:
Platform: SiYuan
Version: master eef105683
Vulnerability: Information Disclosure
Severity: Critical
date: 4 Sep 2026
Prediction: Next stable release
What Undercode Say:
Retrieve the key-derivation material (anonymous or RoleReader)
curl -X POST http://127.0.0.1:6808/api/system/getConf \
-H "Content-Type: application/json" -d '{}'
Retrieve the wrapped per-notebook data key (replace <NOTEBOOK_ID>)
curl -X POST http://127.0.0.1:6808/api/notebook/getNotebookConf \
-H "Content-Type: application/json" -d '{"notebook":"<NOTEBOOK_ID>"}'
Expected response fields: notebookCrypto { MasterSalt, KDFParams, KEKVerifier, VerifierNonce, KEKMAC }
and BoxCrypt { WrappedDEK, WrapNonce }
Exploit: (Educational Purposes!)
- Use the retrieved MasterSalt and KDFParams to compute KEK for each candidate password via Argon2id.
- Verify candidate using KEKVerifier (AES‑GCM decrypt with KEK and VerifierNonce, check against fixed magic) or KEKMAC (HMAC‑SHA256).
- Once the correct master password is found, derive the KEK and decrypt WrappedDEK using AES‑GCM with WrapNonce to obtain the data‑encryption key.
- Use the data key to decrypt each .sy file of the notebook (AES‑GCM).
All steps run locally, no server interaction needed; use hashcat with mode ‑m (Argon2id) for GPU acceleration.
Protection: from this CVE
- In HideConfSecret(), replace NotebookCrypto with a minimal struct containing only an `enabled` boolean for non‑administrators; strip MasterSalt, KDFParams, KEKVerifier, VerifierNonce, and KEKMAC.
- Apply reader filtering to getNotebookConf and getNotebookInfo so that BoxCrypt (including WrappedDEK and WrapNonce) is omitted for non‑administrator roles.
- Alternatively, disable anonymous publish access by setting Publish.Auth.Enable to true and restrict RoleReader tokens to trusted parties only.
Impact:
An unauthenticated remote attacker (or any publish RoleReader) can retrieve all offline cracking material and the wrapped data key, reducing the security of every encrypted notebook to the strength of the master password against GPU‑based offline attacks. No rate limiting, lockout, or logging applies because the attack runs entirely off‑server. The confidentiality of all notebook content is effectively broken if the master password is weak or moderately strong against modern cracking hardware.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
