Description

SiYuan has Arbitrary Document Reading within the Publishing Service

Details

Document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents.

PoC

#!/usr/bin/env python3
"""SiYuan /api/block/getChildBlocks 文档内容读取"""
import requests
import json
import sys

def get_child_blocks(target_url, doc_id):
    """...
Show more

Impact

File reading: All encrypted or prohibited documents under the publishing service could be read.

Mitigation

Aliases

References