Description

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-17T11:16:40.017Z",
  "pubdate": "2026-08-17T11:16:40.017Z",
  "executiveSummary": "SiYuan before 3.7.4 suffers from an unauthenticated debugging endpoint exposure vulnerability. The application improperly registers Go net/http/pprof debug endpoints, including heap and goroutine dumps, without requiring authentication when the --mode flag is not explicitly set to prod.\nThis vulnerability allows remote unauthenticated attackers to access sensitive diagnostic endpoints such as /debug/pprof/heap and related URIs over the network. Successful exploitation enables unauthorized extraction of sensitive in-memory data, including critical security credentials such as AccessAuthCode and AI provider API keys.\nThe risk implication is severe, as the exposure of these secrets can lead to complete compromise of authentication mechanisms and unauthorized access to external integrated services utilizing harvested API keys. Exploitation requires network access to the running instance when the deployment mode is misconfigured or defaults to non-production environments.",
  "technicalDetails": "The vulnerability resides in the application initialization logic of SiYuan before 3.7.4, where Go's standard net/http/pprof profiling package is conditionally integrated based on the runtime command-line arguments. Specifically, if the --mode flag is omitted or set to any value other than prod, the application attaches standard performance profiling and debugging handlers to the HTTP multiplexer without enforcing access control or session validation.\nThe vulnerable component consists of the embedded Go net/http/pprof HTTP handlers exposed via the primary web server interface. These endpoints include /debug/pprof/heap, /debug/pprof/goroutine, and related profiling paths. Because no authentication mechanism guards these routes under non-production configurations, any client capable of reaching the listening network port can query them directly.\nThe attack flow proceeds as follows: First, an attacker identifies a target SiYuan instance operating without the strict production mode enforcement. Second, the attacker sends an unauthenticated HTTP GET request directly to endpoints such as /debug/pprof/heap. Third, the application responds with a binary memory profile dump containing raw heap allocations. Finally, the attacker parses the memory dump offline to extract plaintext string artifacts residing in memory at the time of the capture.\nThe post-exploitation impact is characterized by the disclosure of sensitive credentials stored within the application runtime memory. Attackers can harvest the AccessAuthCode used to secure the administrative interface, thereby bypassing authentication entirely. Additionally, active AI provider API keys configured within the application are exposed in memory, permitting unauthorized relay usage and potential financial or data exfiltration risks against third-party AI services."
}