Summary
SiYuan before version 3.8.4 contains a SQL injection vulnerability in the graph query endpoint because the dailyNoteSavePath parameter is concatenated into a database query without adequate escaping or parameterization. On published sites with authentication disabled, an unauthenticated attacker may manipulate this parameter to retrieve arbitrary database rows from notebooks.
Affected context
The issue occurs in SiYuan deployments that expose the graph query endpoint and process the dailyNoteSavePath parameter as part of a SQL statement. Exploitation is more readily possible when a site is published with authentication disabled, allowing requests to reach the endpoint without an authenticated session.
Exploit preconditions
- Attack surface: The published graph query endpoint
- Required access: Network access to the endpoint; authentication may not be required when site authentication is disabled
- Trigger point: Processing of the
dailyNoteSavePathrequest parameter - Why exploitation is possible: User-controlled input is incorporated into SQL without sufficient parameterization or escaping, allowing query structure to be altered
Why this happens
The vulnerability results from constructing SQL statements by concatenating request-controlled data into the query text. This insecure pattern allows input to influence SQL syntax rather than being treated solely as a data value, mapping to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The flaw can permit unintended query operations, including set-based result combination, before authorization boundaries or output handling can contain the result.
Potential impact
- An attacker may read arbitrary rows from accessible application databases
- Notebook contents and related metadata could be disclosed
- Sensitive information stored in other notebooks may be exposed
- Retrieved data could support further attacks against users or connected services
- Database integrity could be affected if additional query capabilities are reachable
General mitigation guidance
Mitigation generally focuses on ensuring that request data never becomes executable SQL syntax.
Common defensive patterns include:
- Use parameterized queries or prepared statements for all dynamic values
- Prefer narrowly scoped query builders or data-access APIs over string-based SQL construction
- Apply allowlisted validation for path-like parameters and enforce expected formats
- Keep authentication enabled for published sites unless unauthenticated access is explicitly required
- Enforce least-privilege database accounts with read and write permissions limited to necessary objects
- Minimize sensitive data returned by graph and search endpoints
- Centralize authorization and output filtering before database results are exposed
How teams detect issues like this
Detection approaches commonly include:
- Static analysis rules identifying SQL strings built through concatenation or interpolation of request parameters
- Code review checks for missing prepared statements around endpoint-controlled values
- Dynamic testing with database-aware input variations in isolated environments
- Web application firewall or API gateway policies for anomalous query-oriented input patterns
- Monitoring for unusual graph endpoint usage, broad result volumes, and repeated requests from unauthenticated clients
- Automated security review tools that flag CWE-89 patterns during CI analysis
