CVE-2025-68948
📋 TL;DR
This vulnerability allows attackers to decrypt session cookies and steal authentication credentials in SiYuan Note software. Attackers who intercept session cookies can extract the AccessAuthCode and hijack user sessions. All users running SiYuan Note versions 3.5.1 and earlier are affected.
💻 Affected Systems
- SiYuan Note
📦 What is this software?
Siyuan by B3log
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, unauthorized access to all user knowledge bases, potential data theft or destruction.
Likely Case
Session hijacking leading to unauthorized access to user's personal knowledge management system and data.
If Mitigated
Limited impact with proper network segmentation and monitoring, but authentication bypass remains possible.
🎯 Exploit Status
Exploitation requires obtaining session cookies first, but decryption process is straightforward once cookies are acquired.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.2 or later
Vendor Advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f7ph-rc3w-qp28
Restart Required: Yes
Instructions:
1. Backup your SiYuan data
2. Download SiYuan version 3.5.2 or later from official sources
3. Install the updated version
4. Restart the SiYuan application
🔧 Temporary Workarounds
Network Isolation
allRestrict access to SiYuan instances to trusted networks only
Session Management
allImplement additional session validation and monitoring
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach SiYuan instances
- Monitor for unusual session activity and implement additional authentication layers
🔍 How to Verify
Check if Vulnerable:
Check SiYuan version in application settings or about dialog. If version is 3.5.1 or earlier, you are vulnerable.Check Version:
Check version in SiYuan application settings or about dialog (no CLI command available)Verify Fix Applied:
Verify SiYuan version is 3.5.2 or later after update.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login from different IP
- Unusual session creation patterns
- Access from unexpected locations
Network Indicators:
- Unusual traffic patterns to SiYuan session endpoints
- Multiple session cookie requests from same source
SIEM Query:
source="siyuan" AND (event="session_created" OR event="authentication") | stats count by src_ip, user