{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asiyuan-notesiyuan/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:siyuan-note:siyuan:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-72801"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SiYuan Kernel (\u003c 0.0.0-20260724102025-3bc014c7dc32)","SiYuan kernel (\u003c 0.0.0-20260724091654-82e9ded423e4)","SiYuan Kernel (\u003c 0.0.0-20260723031701-9c16e9851f0b)","SiYuan kernel (\u003c 0.0.0-20260721013353-69db783b782a)"],"_cs_severities":["high"],"_cs_tags":["info-disclosure","cve","cryptanalysis","authentication-bypass","webserver"],"_cs_type":"advisory","_cs_vendors":["SiYuan"],"content_html":"\u003cp\u003eSiYuan kernel versions prior to 0.0.0-20260724102025-3bc014c7dc32 contain an information disclosure vulnerability (CVE-2026-72801) affecting the handling of encrypted notebook configuration metadata. Specifically, two API endpoints, \u003ccode\u003e/api/system/getConf\u003c/code\u003e and \u003ccode\u003e/api/notebook/getNotebookConf\u003c/code\u003e, fail to properly redact sensitive cryptographic material when accessed by non-administrator roles.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated remote attacker or an unauthorized publish reader can retrieve the Argon2id salt, key derivation function (KDF) parameters, and master password verifiers (KEKVerifier/KEKMAC). Furthermore, the attacker can obtain the wrapped per-notebook data encryption key (WrappedDEK). Because these endpoints do not implement rate limiting or server-side auditing of guesses, an attacker can perform high-speed offline GPU cracking of the master password. Once the master password is recovered, the attacker uses the retrieved wrapped data key to decrypt notebook content. This vulnerability moves the threat of an offline filesystem attack to a remote, network-accessible pre-authentication exploitation vector.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a SiYuan instance with publish mode enabled (default port 6808).\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the \u003ccode\u003e/api/system/getConf\u003c/code\u003e endpoint using a low-privilege \u003ccode\u003eRoleReader\u003c/code\u003e token or as an anonymous reader if \u003ccode\u003ePublish.Auth.Enable\u003c/code\u003e is set to false.\u003c/li\u003e\n\u003cli\u003eThe server erroneously returns the \u003ccode\u003eNotebookCrypto\u003c/code\u003e object, providing the attacker with the \u003ccode\u003eMasterSalt\u003c/code\u003e, \u003ccode\u003eKDFParams\u003c/code\u003e, \u003ccode\u003eKEKVerifier\u003c/code\u003e, and \u003ccode\u003eKEKMAC\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker calls \u003ccode\u003e/api/notebook/getNotebookConf\u003c/code\u003e with a target \u003ccode\u003enotebook_id\u003c/code\u003e to retrieve the \u003ccode\u003eBoxCrypt.WrappedDEK\u003c/code\u003e and \u003ccode\u003eWrapNonce\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker performs offline brute-force or dictionary attacks against the Argon2id KDF parameters using locally managed GPU clusters.\u003c/li\u003e\n\u003cli\u003eSuccessful password recovery derives the Key Encryption Key (KEK).\u003c/li\u003e\n\u003cli\u003eAttacker decrypts the \u003ccode\u003eWrappedDEK\u003c/code\u003e to obtain the notebook's master Data Encryption Key (DEK).\u003c/li\u003e\n\u003cli\u003eAttacker uses the DEK to decrypt the target notebook files, resulting in full data compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized remote parties to bypass the security of encrypted notebooks. Since the attack occurs entirely offline using retrieved parameters, it cannot be detected or blocked by server-side intrusion prevention systems. A successful attack results in the total loss of confidentiality for all notebooks stored within the compromised SiYuan instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching the SiYuan kernel to version 0.0.0-20260724102025-3bc014c7dc32 or later. Ensure that the \u003ccode\u003eHideConfSecret\u003c/code\u003e function correctly excludes all \u003ccode\u003eNotebookCrypto\u003c/code\u003e fields for non-administrator roles, and verify that reader role filtering is enforced across all \u003ccode\u003eBoxCrypt\u003c/code\u003e related endpoints. Monitor web access logs for high-frequency POST requests to \u003ccode\u003e/api/system/getConf\u003c/code\u003e and \u003ccode\u003e/api/notebook/getNotebookConf\u003c/code\u003e originating from unauthorized or anonymous user agents.\u003c/p\u003e\n","date_modified":"2026-09-04T00:05:15Z","date_published":"2026-09-04T00:04:19Z","id":"https://feed.craftedsignal.io/briefs/2026-09-siyuan-info-disclosure/","summary":"An information disclosure vulnerability in SiYuan's API allows unauthorized remote readers to retrieve cryptographic material necessary for offline, unthrottled GPU-based cracking of encrypted notebook master passwords.","title":"Information Disclosure in SiYuan Kernel Enabling Offline Password Cracking","url":"https://feed.craftedsignal.io/briefs/2026-09-siyuan-info-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:siyuan-Note:siyuan:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}