Description

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-12T20:17:50.977Z",
  "pubdate": "2026-08-12T20:17:50.977Z",
  "executiveSummary": "An information disclosure vulnerability exists in Siyuan versions prior to v3.7.4, specifically involving the exposure of sensitive cryptographic material via an API endpoint. The vulnerability is triggered when the application operates in publish mode, allowing unauthenticated remote attackers to access the /api/system/getConf endpoint.\nUpon accessing this endpoint, the system inadvertently returns the internal CookieKey value used for signing session cookies. Retrieval of this cryptographic secret completely undermines the integrity and confidentiality of the session management mechanism.\nArmed with the session cookie signing key, an unauthenticated attacker possesses the capability to cryptographically forge valid session cookies for any user account within the system. This enables severe post-exploitation impact, including complete session hijacking, unauthorized user impersonation, and the acquisition of administrative access privileges.\nThe risk implications are critical, as the vulnerability requires zero prior authentication or elevated privileges, lowering the exploitation barrier to a simple HTTP GET request against a network-exposed instance running in publish mode. Remediation necessitates updating the affected software to version v3.7.4 or later where the sensitive configuration disclosure is resolved.",
  "technicalDetails": "The vulnerability resides within the configuration management and API routing logic of Siyuan, specifically handling system configuration requests exposed through the /api/system/getConf endpoint.\nThe root cause of the vulnerability stems from improper access control and excessive data exposure in publish mode. When the application runs in this specific operational mode, the API endpoint fails to restrict sensitive internal configuration parameters, inadvertently serializing and returning internal application secrets to callers.\nThe vulnerable component is the configuration retrieval subsystem handling system parameters, which exposes the CookieKey—the cryptographic secret utilized by the backend to sign and verify session cookies—to arbitrary external entities.\nAffected versions comprise all Siyuan deployments prior to v3.7.4. The network exposure is direct, as the endpoint is accessible over the network interface without requiring any authentication credentials or prior session establishment when the application operates in publish mode.\nThe step-by-step exploitation flow proceeds as follows: First, an unauthenticated attacker identifies a targeted Siyuan instance running in publish mode. Second, the attacker sends an unauthenticated HTTP request to the /api/system/getConf endpoint. Third, the application processes the request and responds with a JSON payload containing internal system configurations, notably including the raw CookieKey value. Fourth, the attacker extracts the CookieKey from the HTTP response body.\nIn the post-exploitation phase, the attacker leverages the retrieved cryptographic signing key to construct arbitrary session identifiers. By utilizing the signing algorithm implemented by the application alongside the extracted CookieKey, the attacker crafts forged session cookies that pass cryptographic validation checks on subsequent requests.\nBy injecting these forged cookies into HTTP headers, the attacker successfully impersonates arbitrary users or elevates their authorization level to administrative privileges, thereby achieving total compromise of the application's access control boundaries without requiring valid credentials or interacting with standard authentication routines."
}