Listen to this Post
The vulnerability in SiYuan Note v3.5.3 stems from inadequate path validation in the `/api/file/globalCopyFiles` endpoint. This function, located in api/file.go, processes authenticated POST requests containing a JSON array of source paths (srcs). While the code checks for file existence via filelock.IsExist(src), it completely omits verification that the source path resides within the application’s sanctioned workspace directory. An attacker can submit a request with a source path pointing to any location on the server filesystem, such as `/etc/passwd` or ../../docker-compose.yml. The function then proceeds to copy this arbitrary file into the workspace destination using filelock.Copy(src, dest). Once copied, the file is treated as a legitimate workspace asset and can be retrieved through the application’s standard file download APIs. This logic flaw bypasses all intended directory restrictions, allowing authenticated users to read sensitive system and configuration files. The absence of path sanitization or whitelisting makes this vulnerability straightforward to exploit, leading to a severe breach of confidentiality and potential server compromise.
Platform: SiYuan Note
Version: v3.5.3
Vulnerability: Arbitrary File Read
Severity: Critical
date: Not specified
Prediction: Patch date unknown
What Undercode Say:
Analytics
curl -X POST http://localhost:6806/api/file/globalCopyFiles -H “Authorization: Token $(siyuan-token)” -d ‘{“srcs”:[“/etc/passwd”],”dest”:”/”}’
curl -X GET http://localhost:6806/api/file/getFile?path=/passwd
Code snippet from api/file.go
func globalCopyFiles(c gin.Context) {
srcsArg := arg[“srcs”].([]interface{})
for _, src := range srcs {
if !filelock.IsExist(src) { … }
if err := filelock.Copy(src, dest); err != nil { … }
}
}
how Exploit:
Send crafted POST request to globalCopyFiles endpoint with arbitrary source path like /etc/passwd. Then download the copied file via standard getFile API.
Protection from this CVE
Implement path validation. Restrict source paths to workspace. Apply input sanitization.
Impact:
Complete loss confidentiality. Server file disclosure. Credential harvesting infrastructure compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
