Description

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T12:19:30.780Z",
  "pubdate": "2026-08-18T12:19:30.780Z",
  "executiveSummary": "SiYuan before v3.7.4 suffers from a Server-Side Request Forgery (SSRF) vulnerability residing in the network utility functions of its kernel. Specifically, the flaw exists within the isPrivateIP function located in kernel/util/net.go, which is utilized by SSRFSafeDialer to enforce SSRF mitigation mechanisms when SafeMode is active. The vulnerability stems from incomplete input validation and filtering logic regarding IPv6 address spaces, failing to restrict IPv6 transition addresses that encapsulate private IPv4 addresses.\nThis security deficiency allows an authenticated attacker to bypass implemented SSRF defense mechanisms. By exploiting the network forward proxy, WebSocket proxy, or Server-Sent Events (SSE) proxy endpoints, a malicious actor can supply carefully crafted target URLs. These hostnames resolve to specialized IPv6 transition mechanisms, ultimately routing requests to internal network services and cloud metadata endpoints such as 169.254.169.254.\nThe operational impact is severe due to the behavior of the forward proxy component, which returns the complete response body to the caller, resulting in a full-read SSRF condition. This enables attackers to exfiltrate sensitive cloud instance credentials, query internal infrastructure services, and perform internal network reconnaissance and port scanning.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the isPrivateIP function within the kernel/util/net.go source file of SiYuan. This function is leveraged by the SSRFSafeDialer component to enforce access controls and security boundaries during SafeMode execution. The primary responsibility of isPrivateIP is to inspect destination IP addresses and block connections targeting loopback addresses, link-local unicast ranges, private IPv4 networks, and unspecified addresses.\nThe root cause of the vulnerability is the lack of comprehensive address validation for IPv6 transition technologies. While the blocklist correctly identifies standard restricted IPv4 and IPv6 ranges, it fails to recognize and filter specialized IPv6 transition mechanisms that embed private IPv4 addresses. Specifically, the implementation does not account for NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32) address blocks. Consequently, an IPv6 address constructed using these transition prefixes can successfully pass the isPrivateIP validation checks.\nExploitation requires authentication within the SiYuan application, as the vulnerable pathways are exposed through specific application-layer proxy features. An authenticated attacker initiates the attack flow by targeting the network forward proxy, WebSocket proxy, or SSE proxy endpoints. The attacker crafts a request containing a malicious URL or hostname that resolves to an IPv6 transition address embedding a restricted internal IPv4 destination, such as the cloud instance metadata service at 169.254.169.254.\nWhen the SSRFSafeDialer evaluates the destination during the connection establishment phase, isPrivateIP processes the transition address and incorrectly assesses it as safe, bypassing the security guard. The underlying networking stack then translates or routes the request to the embedded internal IPv4 address. Because the forward proxy returns the full HTTP response body back to the client, the attacker achieves arbitrary read capabilities against internal resources. Post-exploitation impacts include the theft of cloud instance metadata credentials, unauthorized interaction with internal microservices, and internal network mapping via port scanning."
}