Description

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-17T11:16:40.897Z",
  "pubdate": "2026-08-17T11:16:40.897Z",
  "executiveSummary": "A cross-site request forgery vulnerability exists in SiYuan versions before 3.7.4 within the session-cookie authentication branch of the CheckAuth() function.\nThe vulnerability arises due to the lack of Origin and Referer header validation combined with the absence of an explicit SameSite attribute configuration on session cookies.\nThis security deficiency allows remote attackers to craft malicious web pages designed to execute unauthorized state-changing operations on behalf of an authenticated user.\nWhen a targeted user visits an attacker-controlled website while maintaining an active session in SiYuan, the browser automatically attaches the valid session cookie to cross-origin requests.\nBecause the server relies entirely on browser default SameSite policies rather than enforcing robust server-side protections or request origin validation, the unauthorized requests are processed successfully.\nThe impact of successful exploitation includes the execution of arbitrary administrative or user-level actions within the application context, potentially leading to data manipulation, unauthorized configurations, or complete compromise of the authenticated user session.\nMitigation requires upgrading the affected software to version 3.7.4 or later, where proper session cookie attribute configurations and request validation controls are implemented.",
  "technicalDetails": "The vulnerability is localized within the session-cookie authentication branch of the CheckAuth() function in SiYuan versions prior to 3.7.4.\nThe root cause of the flaw stems from two primary architectural omissions: first, the application fails to validate the Origin and Referer HTTP headers to verify the context of incoming state-changing requests; second, it fails to explicitly configure the SameSite attribute on issued session cookies.\nBy omitting the SameSite attribute, the application delegates session boundary enforcement entirely to the discretion of the victim's web browser default behavior, which may allow cookies to be sent along with cross-site requests depending on browser implementation and context.\nThe attack flow proceeds as follows: an attacker hosts a malicious web page designed to issue automated cross-origin HTTP requests (such as via HTML forms, JavaScript fetch API calls, or image tags configured for POST/GET actions) targeting the vulnerable SiYuan instance.\nAn authenticated user who has an active session with the SiYuan application visits the attacker's malicious web page.\nThe browser constructs the outgoing request to the SiYuan server and automatically appends the user's valid session cookie due to standard browser cookie-inclusion rules for domain-scoped resources.\nUpon receiving the request, the CheckAuth() function validates the presence of the session cookie but fails to inspect the Origin or Referer headers to ensure the request originated from a trusted context.\nConsequently, the server authenticates the request as originating from the legitimate user and processes the embedded payload or action, permitting unauthorized state changes.\nAuthentication requirements for the target are implicitly bypassed through the automated reuse of the victim's valid session state, requiring no prior credential knowledge by the attacker.\nNetwork exposure is defined by the accessibility of the SiYuan server instance to the victim's browser, which can be deployed on local networks or exposed directly to the public internet.\nPost-exploitation impact is dictated by the permission level of the authenticated victim, ranging from unauthorized data modification to administrative configuration changes within the SiYuan environment."
}