SiYuan hat einen beliebigen Dateischreibzugriff auf dem Host über /api/asset/upload in github.com/siyuan-note/siyuan/kernel

The arbitrary file write capability afforded by CVE-2024-55659 presents a significant security risk. An attacker could leverage this vulnerability to overwrite critical system files, potentially gaining remote code execution (RCE) on the affected server. This could lead to complete system compromise, including data exfiltration, denial of service, and the installation of persistent malware. The impact is amplified if the SiYuan instance is deployed in a production environment or handles sensitive user data. Successful exploitation could also allow an attacker to modify application configuration files, altering the application's behavior and potentially creating further vulnerabilities.

Organizations and individuals using SiYuan for knowledge management, particularly those running versions prior to 3.1.16, are at risk. This includes teams relying on SiYuan for internal documentation, research, or collaboration. Shared hosting environments where SiYuan is deployed could be particularly vulnerable, as a compromised instance could potentially impact other tenants.

• go / server:

find /var/log -name "siyuan.log*" -print0 | xargs -0 grep -i "/api/asset/upload"

• generic web:

curl -I <siyuan_url>/api/asset/upload | grep -i 'content-type'

• linux / server:

journalctl -u siyuan -f | grep -i "/api/asset/upload"

1. 2024-12-12Disclosure

   disclosure

1. Reserviert2024-12-10
2. Veröffentlicht2024-12-12
3. Geändert2026-03-03
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-55659 is to immediately upgrade SiYuan to version 3.1.16 or later. If an immediate upgrade is not feasible due to compatibility concerns or downtime constraints, consider implementing temporary workarounds. While a direct WAF rule to block the /api/asset/upload endpoint is not practical, restricting file upload types and sizes can reduce the attack surface. Thoroughly review and validate all uploaded files to prevent malicious content from being stored on the server. Implement robust input validation and sanitization to prevent attackers from manipulating file paths. After upgrading, confirm the fix by attempting to upload a file with a potentially malicious filename and verifying that the upload is rejected or handled securely.