CVE-2024-53504: B3log Siyuan SQL Injection Vulnerability

CVE-2024-53504 Overview

A SQL injection vulnerability has been identified in Siyuan 3.1.11, a popular open-source note-taking application developed by B3log. The vulnerability exists in the /searchHistory endpoint and can be exploited through the notebook parameter. This flaw allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized data access, data manipulation, or complete database compromise.

Critical Impact
Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially achieve full system compromise through database-level operations.

Affected Products

B3log Siyuan version 3.1.11

Discovery Timeline

2024-11-29 - CVE-2024-53504 published to NVD
2025-04-14 - Last updated in NVD database

Technical Details for CVE-2024-53504

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) in Siyuan 3.1.11 allows attackers to manipulate SQL queries through unsanitized user input. The vulnerable endpoint /searchHistory fails to properly validate or sanitize the notebook parameter before incorporating it into database queries. This classic injection pattern enables attackers to break out of the intended query context and execute arbitrary SQL commands.

The vulnerability is particularly concerning because it requires no authentication, meaning any network-accessible instance of Siyuan is potentially at risk. Successful exploitation could result in complete compromise of data confidentiality, integrity, and availability within the application's database.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the /searchHistory endpoint. When user-supplied data from the notebook parameter is directly concatenated into SQL queries without proper sanitization or the use of prepared statements, it creates an injection point that attackers can exploit. This represents a fundamental secure coding failure that should be addressed through the implementation of parameterized queries or robust input validation.

Attack Vector

This vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker can craft malicious HTTP requests to the /searchHistory endpoint, injecting SQL payloads through the notebook parameter. The attack can be executed remotely against any network-accessible Siyuan instance running the vulnerable version.

The exploitation process typically involves:

Identifying a vulnerable Siyuan instance accessible over the network
Crafting malicious SQL injection payloads targeting the notebook parameter
Sending requests to the /searchHistory endpoint with the injection payload
Extracting sensitive data or manipulating database contents based on the query results

For technical details regarding this vulnerability, refer to the GitHub Issue #13058 and GitHub Issue #13077 on the official Siyuan repository.

Detection Methods for CVE-2024-53504

Indicators of Compromise

Unusual or malformed requests to the /searchHistory endpoint containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
Database error messages in application logs indicating SQL syntax errors
Unexpected database queries or operations not initiated by legitimate application functions
Evidence of data exfiltration or unauthorized database access in audit logs

Detection Strategies

Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to /searchHistory
Monitor HTTP access logs for requests containing suspicious characters or SQL keywords in the notebook parameter
Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack patterns
Enable database query logging to identify anomalous or unauthorized queries

Monitoring Recommendations

Configure alerting for repeated failed database queries that may indicate injection attempts
Monitor for unusual database response sizes that could indicate data exfiltration
Implement rate limiting on the /searchHistory endpoint to slow potential automated attacks
Review application logs regularly for evidence of exploitation attempts

How to Mitigate CVE-2024-53504

Immediate Actions Required

Upgrade Siyuan to a patched version that addresses this vulnerability
If upgrade is not immediately possible, restrict network access to the Siyuan instance using firewall rules
Implement a web application firewall (WAF) with SQL injection protection in front of the application
Audit database logs for any signs of unauthorized access or data manipulation

Patch Information

B3log has been notified of this vulnerability through GitHub issues. Users should monitor the official Siyuan repository for security updates and upgrade to a patched version as soon as one becomes available. For more information, see GitHub Issue #13058 and GitHub Issue #13077.

Workarounds

Restrict access to the Siyuan application to trusted networks only using firewall rules or VPN
Deploy a reverse proxy with WAF capabilities to filter malicious requests before they reach the application
Disable or limit access to the /searchHistory functionality if it is not critical to operations
Consider running Siyuan in an isolated network environment until a patch is available

bash

# Example: Restrict access to Siyuan using iptables
# Only allow access from trusted IP range
iptables -A INPUT -p tcp --dport 6806 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6806 -j DROP