SiYuan <= v3.7.2: SQL Injection via /api/search/searchEmbedBlock
- Severity
- HIGH
- Affected component
- siyuan-note/siyuan (github-actions)
- Patched version
- v3.7.3
An early warning has been issued for a critical SQL injection vulnerability affecting SiYuan versions up to and including v3.7.2. Users of these versions are advised to take immediate action.
What happened
An early warning has been issued regarding a critical SQL injection vulnerability in SiYuan versions up to and including v3.7.2. The vulnerability, tracked as GHSA-P2X7-4C4P-8WH6 and GHSA-VH22-H7HF-WWW7, involves the /api/search/searchEmbedBlock endpoint. This endpoint allows a client-supplied SQL statement to be passed verbatim to the main read-write siyuan.db handle without any single-statement, read-only, or admin restrictions. This could potentially allow an attacker to execute arbitrary SQL commands.
The vulnerability has not been reported as exploited in the wild. However, given the severity and the potential impact, it is crucial for users to assess their exposure and take appropriate action. The issue has been addressed in SiYuan v3.7.3, which includes necessary patches to mitigate the vulnerability.
What to do about it
- Upgrade to SiYuan v3.7.3 or later to mitigate the SQL injection vulnerability.
- Review your application's use of the /api/search/searchEmbedBlock endpoint and ensure that proper input validation and sanitization are in place.
- Monitor the primary sources for any updates or additional information regarding this vulnerability.
How 0Day would have caught this
siyuan-note/siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using SiYuan versions up to and including v3.7.2, you are potentially affected by this vulnerability.
What should I do right now?
Immediately upgrade to SiYuan v3.7.3 or later to mitigate the SQL injection vulnerability.
Has this vulnerability been patched?
Yes, the vulnerability has been addressed in SiYuan v3.7.3.
Where can I find more information about this vulnerability?
Consult the primary sources for more detailed information: GHSA-p2x7-4c4p-8wh6 and GHSA-vh22-h7hf-www7.