CVE-2024-53504: B3log Siyuan SQL Injection Vulnerability

CVE-2024-53504 Overview

A SQL injection vulnerability has been identified in Siyuan 3.1.11, a popular open-source note-taking application developed by B3log. The vulnerability exists in the /searchHistory endpoint and can be exploited through the notebook parameter. This flaw allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized data access, data manipulation, or complete database compromise.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially achieve full system compromise through database-level operations.

Affected Products

• B3log Siyuan version 3.1.11

Discovery Timeline

• 2024-11-29 - CVE-2024-53504 published to NVD
• 2025-04-14 - Last updated in NVD database

Technical Details for CVE-2024-53504

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) in Siyuan 3.1.11 allows attackers to manipulate SQL queries through unsanitized user input. The vulnerable endpoint /searchHistory fails to properly validate or sanitize the notebook parameter before incorporating it into database queries. This classic injection pattern enables attackers to break out of the intended query context and execute arbitrary SQL commands.

The vulnerability is particularly concerning because it requires no authentication, meaning any network-accessible instance of Siyuan is potentially at risk. Successful exploitation could result in complete compromise of data confidentiality, integrity, and availability within the application's database.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the /searchHistory endpoint. When user-supplied data from the notebook parameter is directly concatenated into SQL queries without proper sanitization or the use of prepared statements, it creates an injection point that attackers can exploit. This represents a fundamental secure coding failure that should be addressed through the implementation of parameterized queries or robust input validation.

Attack Vector

This vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker can craft malicious HTTP requests to the /searchHistory endpoint, injecting SQL payloads through the notebook parameter. The attack can be executed remotely against any network-accessible Siyuan instance running the vulnerable version.

The exploitation process typically involves:

1. Identifying a vulnerable Siyuan instance accessible over the network
2. Crafting malicious SQL injection payloads targeting the notebook parameter
3. Sending requests to the /searchHistory endpoint with the injection payload
4. Extracting sensitive data or manipulating database contents based on the query results

For technical details regarding this vulnerability, refer to the GitHub Issue #13058 and GitHub Issue #13077 on the official Siyuan repository.

Detection Methods for CVE-2024-53504

Indicators of Compromise

• Unusual or malformed requests to the /searchHistory endpoint containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
• Database error messages in application logs indicating SQL syntax errors
• Unexpected database queries or operations not initiated by legitimate application functions
• Evidence of data exfiltration or unauthorized database access in audit logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to /searchHistory
• Monitor HTTP access logs for requests containing suspicious characters or SQL keywords in the notebook parameter
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack patterns
• Enable database query logging to identify anomalous or unauthorized queries

Monitoring Recommendations

• Configure alerting for repeated failed database queries that may indicate injection attempts
• Monitor for unusual database response sizes that could indicate data exfiltration
• Implement rate limiting on the /searchHistory endpoint to slow potential automated attacks
• Review application logs regularly for evidence of exploitation attempts

How to Mitigate CVE-2024-53504

Immediate Actions Required

• Upgrade Siyuan to a patched version that addresses this vulnerability
• If upgrade is not immediately possible, restrict network access to the Siyuan instance using firewall rules
• Implement a web application firewall (WAF) with SQL injection protection in front of the application
• Audit database logs for any signs of unauthorized access or data manipulation

Patch Information

B3log has been notified of this vulnerability through GitHub issues. Users should monitor the official Siyuan repository for security updates and upgrade to a patched version as soon as one becomes available. For more information, see GitHub Issue #13058 and GitHub Issue #13077.

Workarounds

• Restrict access to the Siyuan application to trusted networks only using firewall rules or VPN
• Deploy a reverse proxy with WAF capabilities to filter malicious requests before they reach the application
• Disable or limit access to the /searchHistory functionality if it is not critical to operations
• Consider running Siyuan in an isolated network environment until a patch is available

# Example: Restrict access to Siyuan using iptables
# Only allow access from trusted IP range
iptables -A INPUT -p tcp --dport 6806 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6806 -j DROP