Summary

The SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.

Details

The vulnerability is rooted in the improper initialization of the session store within the server code.

• Vulnerable Component: kernel/server/serve.go

• Vulnerability Type: CWE-321: Use of Hard-coded Cryptographic Key

• Root Cause:
  The application initializes the cookie store using a static string found in the source code as the encryption/signing key.

  In SiYuan's architecture, the AccessAuthCode (the user's proof of identity) is stored inside the session cookie. Under normal circumstances, session cookies are opaque and tamper-proof. However, since the key is public, the session cookie is effectively cleartext to anyone with access to the GitHub repository.

• Attack Scenario:

  1. A user logs into SiYuan Note. The server generates a session cookie containing the encrypted AccessAuthCode.
  2. An attacker intercepts this cookie (e.g., on a LAN via unencrypted HTTP, or via client-side scripts).
  3. Using the hardcoded key from kernel/server/serve.go, the attacker decrypts the intercepted cookie.
  4. The attacker retrieves the raw AccessAuthCode.
  5. The attacker uses this code to authenticate directly, effectively taking over the account.

PoC

The following Proof of Concept demonstrates that the session cookie encryption is broken and allows the extraction of sensitive credentials.

1. Vulnerable Code Reference:
   Locate the initSession function in kernel/server/serve.go in the official repository.

2. Reproduction Tool:
   A script has been prepared to demonstrate the decryption process. It uses the hardcoded key to parse the SiYuan session cookie.

   • PoC Script: https://gist.github.com/28Hus/1dfc3e2abaf9b099686c992296a89c8f

3. Steps to Reproduce:

   • Log in to a SiYuan instance to generate a valid session.
   • Copy the value of the session cookie from the browser developer tools.
   • Run the PoC script provided in the link above, passing the cookie value as input.
   • Result: The script successfully decrypts the payload and outputs the valid AccessAuthCode.

Impact

• Data Confidentiality Loss: The session encryption is rendered useless, exposing internal session values.
• Credential Theft: The most critical impact is the exposure of the AccessAuthCode. Unlike a standard session ID hijacking (which ends when the session expires), obtaining the AccessAuthCode allows the attacker to maintain access or generate new valid sessions at will.
• Account Takeover: With the auth code, an attacker gains full administrative control over the SiYuan instance, leading to access to private notes and potential server compromise.