Listen to this Post
The CVE-2024-34068 vulnerability in SiYuan arises from improper path validation in the `/api/file/copyFile` endpoint. In the `copyFile` function within kernel/api/file.go, the `dest` parameter is directly taken from user input without any sanitization or validation. While the `src` parameter is correctly validated using `model.GetAssetAbsPath()` to ensure it resides within the intended asset directory, the `dest` string is passed unchecked to the `filelock.Copy` function. This allows an authenticated attacker to specify an absolute path for the destination file. Consequently, files can be written outside the restricted workspace directory to any location accessible by the SiYuan process. By manipulating the `dest` parameter, an attacker can overwrite or create files in critical system directories. This arbitrary file write primitive can be leveraged to achieve remote code execution. For instance, writing a malicious script to `/etc/cron.d` schedules its execution, or adding a public key to `~/.ssh/authorized_keys` grants persistent SSH access. The lack of a path traversal check or validation against the workspace root directory is the core flaw. The function does not call any security function to ensure `dest` is a subpath of the permitted area. This bypasses the intended security model where users should only interact with files inside their workspace. The vulnerability is exploitable via a simple API request with a valid authentication token, making it a critical issue for deployment security.
Platform: SiYuan
Version: 3.5.3
Vulnerability: Arbitrary File Write
Severity: Critical
date: Not Specified
Prediction: Patch Expected Soon
What Undercode Say:
Analytics:
curl -X POST “http://target:6806/api/file/putFile” -H “Authorization: Token
id > /tmp/pwned.txt
hostname >> /tmp/pwned.txt’
curl -X POST “http://target:6806/api/file/copyFile” -H “Authorization: Token
func copyFile(c gin.Context) {
src := arg[“src”].(string)
src, err := model.GetAssetAbsPath(src)
dest := arg[“dest”].(string)
if err = filelock.Copy(src, dest); err != nil {
}
}
if !util.IsSubPath(util.WorkspaceDir, dest) {
ret.Code = -1
ret.Msg = “dest path must be within workspace”
return
}
How Exploit:
Upload malicious file.
Copy to sensitive location.
Trigger for RCE.
Protection from this CVE
Validate dest path.
Use IsSubPath check.
Apply workspace restriction.
Impact:
Remote Code Execution.
System Compromise.
Persistence Backdoor.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
