Description

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-26T14:16:46.247Z",
  "pubdate": "2026-09-26T14:16:46.247Z",
  "executiveSummary": "SiYuan versions v2.1.0 through v3.8.3 are susceptible to a critical Cross-Site Request Forgery (CSRF) vulnerability located within the CheckAuth lock-screen pass-through mechanism. This flaw allows unauthorized, zero-credential cross-origin requests to bypass security controls by specifically targeting the loopback interface used by the application's kernel.\nThe vulnerability enables a remote attacker, via a malicious web page visited by the victim, to execute administrative commands against the SiYuan kernel. This grants the attacker unauthorized access to sensitive workspace configurations, internal proxy settings, and the ability to forcibly terminate the kernel process. Because the application fails to validate the Origin header for requests originating from the loopback address, the browser's context is abused to perform unauthorized actions on the user's behalf.\nThe risk implication is severe, as it facilitates full administrative control over the application environment without requiring prior authentication. Successful exploitation requires only that an authenticated user visits an attacker-controlled site while the SiYuan application is running. This bypasses typical session-based security, effectively turning the victim's own browser into a pivot point for administrative exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authentication checks within the CheckAuth function, specifically during the handling of pass-through requests destined for the kernel. The application trust model incorrectly assumes that any request originating from the local loopback interface is inherently trusted and authorized, leading to the omission of Origin header verification.\nIn the affected versions (v2.1.0 to v3.8.3), the SiYuan kernel exposes an API surface that remains reachable via standard web browsers. When the application lock-screen is active, the CheckAuth logic fails to sufficiently restrict state-changing requests. Attackers exploit this by crafting a malicious web page containing a CSRF payload designed to send cross-origin HTTP requests to the local SiYuan kernel port.\nThe attack flow proceeds as follows: First, the attacker lures a target user who has an active SiYuan instance running to a compromised or attacker-controlled website. Second, the malicious site executes a background JavaScript fetch or XHR request directed at the SiYuan loopback URL (typically 127.0.0.1:6806). Because the application lacks strict Origin/Referer validation, it treats these requests as legitimate internal traffic.\nOnce the request is accepted, the attacker can execute several high-privilege actions. By sending specific JSON payloads to the internal API, the attacker can invoke administrative functions, such as kernel termination or configuration manipulation. The lack of CSRF tokens or equivalent anti-forgery mechanisms ensures that these requests are processed as if they were initiated by the authorized user within the legitimate UI.\nFurthermore, the vulnerability grants read access to configuration files, including workspace paths and network proxy settings, which can be leveraged for lateral movement or information exfiltration. Since the SiYuan kernel often runs with the same user privileges as the local OS user, the compromise of the application effectively grants the attacker control over the associated workspace data. The absence of strict authentication enforcement for these pass-through requests effectively renders the 'lock-screen' mechanism inert against CSRF-based bypasses, as the security posture is circumvented before any user-level authorization is validated."
}