Description
SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
siyuan-note siyuan
Default version status: unaffected
0 to ≤ 3.8.4affected
pkg:golang/github.com/siyuan-note/siyuan/kernelReferences
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-whcx-xxqh-c838 ↗
- https://github.com/siyuan-note/siyuan ↗
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/api/router.go#L51 ↗
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/template.go#L485-L526 ↗
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/api/icon.go#L546-L549 ↗
- https://www.vulncheck.com/advisories/siyuan-through-3.8.4-access-control-bypass-via-dynamic-icon-endpoint ↗