Summary
A critical SQL injection vulnerability in SiYuan allows client-supplied SQL to be executed verbatim against the primary siyuan.db database via the /api/search/searchEmbedBlock endpoint.
When exposed to RoleReader tokens or unauthenticated users, this endpoint can be abused to read and modify content across all opened cleartext notebooks through stacked SQL statements.
Affected context
This vulnerability appears in SiYuan deployments that:
- Run versions up to and including v3.7.2
- Expose the /api/search/searchEmbedBlock endpoint over HTTP
- Use the main read-write siyuan.db handle for search operations
- Permit access to the endpoint via publish RoleReader tokens or anonymous access when publish authentication is disabled
Encrypted per-box notebooks are not directly affected, but all opened cleartext notebooks are exposed to arbitrary SQL operations.
Exploit preconditions
- Attack surface: HTTP API endpoint
/api/search/searchEmbedBlock - Required access: Ability to send requests as a publish RoleReader or as an anonymous user when publish authentication is turned off
- Trigger point: The server passes a user-supplied SQL string directly into the siyuan.db driver without restriction
- Why exploitation is possible: There is no enforcement of single-statement execution, read-only semantics, parameterization, or privilege separation; the driver supports stacked statements, allowing attackers to chain arbitrary read and write queries
Why this happens
The core issue is an absence of input sanitization and query parameterization for SQL sent to the database.
Instead of using prepared statements or restricting query shapes, the implementation forwards a raw SQL string from the client to a high-privilege read-write database connection.
This aligns with CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), where user-controlled input is treated as executable SQL and executed with full database privileges.
The design further compounds risk by using a general-purpose handle that can run multiple statements, lacking safeguards such as read-only roles, statement whitelisting, or query parsing.
Potential impact
- Attackers may read all content stored in opened cleartext notebooks
- Attackers may modify, delete, or corrupt notebook data and metadata
- Attackers can perform bulk data exfiltration from the siyuan.db database
- Attackers may insert malicious or misleading content, enabling data poisoning
- Attackers could disrupt application behavior by altering structural tables or indices
General mitigation guidance
Effective mitigation patterns focus on removing direct execution of user-provided SQL and narrowing database privileges.
Recommended approaches include:
- Replacing raw SQL execution with parameterized queries tailored to specific search operations
- Implementing strict query builders or ORM layers that expose only safe, pre-defined operations
- Enforcing read-only roles for endpoints that should never modify data, splitting read and write connections
- Restricting the database API to single, validated statements and disallowing stacked execution
- Applying application-level authorization checks that align data-access scope with user roles instead of exposing generic SQL
Adopting these patterns ensures that client inputs influence search parameters, not executable SQL, and that any compromise of an endpoint yields minimal access.
How teams detect issues like this
Detection typically combines code-level inspection with behavioral monitoring:
- Static analysis rules that flag concatenation of user input into SQL strings or APIs that accept raw SQL from external sources
- Code review guidelines focused on ensuring all database interactions use prepared statements or strongly typed query builders
- Architectural reviews that verify separation of read/write connections and prohibit generic SQL execution in public endpoints
- Runtime monitoring for anomalous SQL patterns, such as stacked statements, unexpected DDL/DML operations from search endpoints, or broad SELECT queries
- Automated application security testing and dynamic scanners configured to probe for SQL injection in search and embedding APIs
