CVE-2024-55660
📋 TL;DR
This CVE describes a Server-Side Template Injection (SSTI) vulnerability in SiYuan's Sprig template engine that allows attackers to access environment variables. Attackers can exploit the /api/template/renderSprig endpoint to potentially read sensitive system information. All SiYuan users running versions before 3.1.16 are affected.
💻 Affected Systems
- SiYuan personal knowledge management system
📦 What is this software?
Siyuan by B3log
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive environment variables containing API keys, database credentials, or other secrets, potentially leading to full system compromise.
Likely Case
Attackers exfiltrate environment variables containing sensitive configuration data, enabling further attacks or data theft.
If Mitigated
Limited information disclosure if environment variables contain only non-sensitive data.
🎯 Exploit Status
SSTI vulnerabilities in template engines are commonly exploited, and the advisory provides technical details that could be weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.16
Vendor Advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp
Restart Required: Yes
Instructions:
1. Stop SiYuan service
2. Backup your data
3. Update to version 3.1.16 or later
4. Restart SiYuan service
🔧 Temporary Workarounds
Disable vulnerable endpoint
allBlock access to the /api/template/renderSprig endpoint
Add firewall rule to block /api/template/renderSprig
Configure web server to deny requests to this endpoint
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SiYuan instances
- Monitor and alert on access to the /api/template/renderSprig endpoint
🔍 How to Verify
Check if Vulnerable:
Check if SiYuan version is below 3.1.16 and the /api/template/renderSprig endpoint is accessibleCheck Version:
Check SiYuan web interface settings or package manager for versionVerify Fix Applied:
Confirm SiYuan version is 3.1.16 or later and test endpoint with known SSTI payloads📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /api/template/renderSprig
- Requests containing template injection payloads
- Multiple failed template rendering attempts
Network Indicators:
- HTTP POST requests to /api/template/renderSprig with suspicious payloads
- Unusual outbound connections after template rendering
SIEM Query:
source="siyuan" AND (uri_path="/api/template/renderSprig" OR message="template render")