CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to v3.7.4 are vulnerable due to insufficient masking of sensitive configuration fields in the /api/system/getConf endpoint, which exposes critical information such as the session-cookie signing key and OS username. This flaw allows unauthorized users to forge session cookies, potentially leading to user impersonation and privilege escalation to administrator levels in instances lacking access-auth codes. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administrator privileges.