SiYuan Kernel <= 3.7.3 Vulnerability: Critical Authentication Bypass
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- siyuan kernel (npm)
- Patched version
- 3.7.4
SiYuan kernel versions before 3.7.4 reportedly contain a critical vulnerability that allows unauthenticated remote attackers to perform unlimited automated guesses of the API token, potentially gaining full RoleAdministrator access.
What happened
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. This vulnerability allows an unauthenticated remote attacker to perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured. Upon success, the attacker gains full RoleAdministrator access, enabling arbitrary file operations and SQL queries.
The vulnerability is due to the CheckAuth() middleware accepting the API token via an Authorization header or a query parameter, without being protected by the application's CAPTCHA/lockout mechanism. This lack of protection enables the attacker to repeatedly guess the API token until successful.
What to do about it
- Upgrade to SiYuan kernel version 3.7.4 or later to mitigate the vulnerability.
- Ensure that strong, complex API tokens are used to reduce the risk of successful automated guesses.
- Monitor your systems for any unusual activity that may indicate an attempted or successful exploit of this vulnerability.
- Consult the primary sources for the most up-to-date information and recommendations.
How 0Day would have caught this
siyuan kernel is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using SiYuan kernel versions before 3.7.4, you are reportedly affected by this vulnerability.
What should I do right now?
Upgrade to SiYuan kernel version 3.7.4 or later as soon as possible. Additionally, ensure that strong, complex API tokens are used.
Is this vulnerability being exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time. However, it is under investigation.