Executive brief
SiYuan is a note-taking application that supports encrypted notebooks protected by a master password. Two API endpoints unintentionally expose the cryptographic key-derivation material and encrypted notebook keys to unauthenticated readers in publish mode, enabling attackers to perform unlimited offline brute-force attacks against the master password without server-side rate limiting or detection. Once the password is cracked, attackers can decrypt all notebook contents.
Technical details
The vulnerability stems from two missing authorization checks in SiYuan's REST API. First, `POST /api/system/getConf` returns the full `NotebookCrypto` configuration object (including `MasterSalt`, `KDFParams`, `KEKVerifier`, `VerifierNonce`, and `KEKMAC`) through a `HideConfSecret()` function that filters other secrets but omits `NotebookCrypto` entirely, making password verification possible offline without server interaction. Second, `POST /api/notebook/getNotebookConf` returns `BoxCrypt.WrappedDEK`—the per-notebook data-encryption key wrapped under the KEK—without reader-role filtering. An unauthenticated client or any publish `RoleReader` can retrieve both endpoints, derive the KEK via Argon2id with a guessed password using the leaked salt and parameters, verify the guess against `KEKVerifier` or `KEKMAC` locally, and then decrypt `WrappedDEK` to obtain the real data-encryption key. The attack is entirely offline with no rate limiting, lockout, or server logging. The patch strips sensitive crypto fields from non-administrator responses and applies reader-role filtering to notebook endpoints.
Affected products
- SiYuan SiYuan before 0.0.0-20260724102025-3bc014c7dc32
Timeline
- 2026-09-03: disclosed: Published to GitHub Advisory Database
- 2026-07-24: patched: Patched version 0.0.0-20260724102025-3bc014c7dc32 released