SiYuan: 授权绕过允许通过搜索 API 执行任意 SQL

该 SQL 注入漏洞的影响极其严重。攻击者可以利用此漏洞执行任意 SQL 语句，从而访问、修改或删除数据库中的敏感数据。攻击者可以窃取用户凭据、笔记内容、以及其他存储在数据库中的信息。更进一步，攻击者可能能够执行数据库管理操作，例如删除表或修改数据库结构，导致应用程序完全瘫痪。由于该漏洞不需要特殊权限，即使是具有“Reader”角色的普通用户也可能利用此漏洞。这与Log4Shell漏洞的潜在影响类似，都可能导致大规模数据泄露和系统破坏。

Organizations and individuals using SiYuan Note, particularly those with sensitive data stored within the application, are at risk. Shared hosting environments where multiple users share a single SiYuan Note instance are especially vulnerable, as a compromised user account could potentially impact the entire environment. Users relying on legacy configurations or outdated versions of SiYuan Note are also at increased risk.

• linux / server: Monitor SiYuan Note application logs for unusual SQL queries, particularly those involving the /api/search/fullTextSearchBlock endpoint. Use journalctl -u siyuan to filter for relevant log entries.

journalctl -u siyuan | grep '/api/search/fullTextSearchBlock'

• database (mysql, redis, mongodb, postgresql): If SiYuan Note uses a database accessible from the server, monitor for suspicious SQL queries. For example, using mysql:

mysql -u <user> -p -e "SHOW PROCESSLIST;"

• generic web: Monitor web server access logs for requests to /api/search/fullTextSearchBlock with unusual parameters. Use grep to search for suspicious patterns.

grep '/api/search/fullTextSearchBlock' /var/log/apache2/access.log

1. 2026-03-13Discovery

   discovery

2. 2026-03-16Disclosure

   disclosure

1. 已保留2026-03-13
2. 发布日期2026-03-16
3. 修改日期2026-03-30
4. EPSS 更新日期2026-03-27

最有效的缓解措施是立即升级到 SiYuan Note 3.6.1 或更高版本。如果无法立即升级，可以尝试以下临时缓解措施：首先，禁用或限制对 /api/search/fullTextSearchBlock 接口的访问。其次，实施严格的输入验证和过滤，以防止恶意 SQL 语句注入。如果使用反向代理或 Web 应用防火墙 (WAF)，请配置规则以检测和阻止 SQL 注入攻击。升级后，请验证数据库完整性，并检查是否有异常活动。