Description

SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-28T12:16:33.120Z",
  "pubdate": "2026-08-28T12:16:33.120Z",
  "executiveSummary": "SiYuan versions prior to v3.1.8 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. The flaw originates from the application's inadequate handling of DNS resolution within the 'http_request' and 'web_fetch' agent tools.\nBy leveraging a DNS rebinding technique, an attacker can circumvent security validations that rely solely on initial guard-time resolution. This allows the application to be manipulated into initiating outbound requests to internal network resources, private IP addresses, or cloud-specific metadata services (e.g., 169.254.169.254).\nThe vulnerability allows an attacker to bypass existing defense mechanisms, potentially leading to unauthorized access to internal services or sensitive configuration data hosted within the local network or cloud environment.\nExploitation requires the attacker to control a malicious DNS server and influence the application's outbound request target. Successful exploitation poses a significant security risk by expanding the attacker's reach into the victim's private infrastructure.",
  "technicalDetails": "The root cause of this SSRF vulnerability is a 'Time-of-Check to Time-of-Use' (TOCTOU) flaw in the application's DNS resolution logic. When the 'http_request' or 'web_fetch' agent tools perform an outbound fetch, they conduct a DNS resolution step to validate the target destination against a blocklist or whitelist (guard-time resolution). However, the application fails to bind the validated result to the subsequent socket connection.\nThe attack flow proceeds as follows: First, the attacker configures a malicious authoritative DNS server to host a domain with a very low Time-To-Live (TTL). When the victim's SiYuan instance initiates a request to this domain, the attacker's server responds to the initial guard-time DNS query with a benign public IP address, successfully passing the application's validation checks.\nImmediately following the guard-time validation, the application proceeds to establish an HTTP connection to the requested domain. This triggers a second DNS resolution (connect-time resolution). At this stage, the attacker's DNS server responds with an internal or restricted IP address, such as an RFC 1918 address or a cloud provider's metadata service endpoint. Because the application does not re-validate this new IP address against its security policy, the underlying network stack connects to the restricted target.\nThis behavior allows the application to effectively tunnel unauthorized requests to internal infrastructure, bypassing the intended security boundaries of the 'http_request' and 'web_fetch' components. The scope of impact includes potential exfiltration of metadata tokens, unauthorized interaction with internal APIs, or probing of sensitive services residing within the local network segment. The flaw is inherent to the logic implemented in the agent tools, specifically affecting all versions of SiYuan prior to v3.8.1."
}