GHSA-3cc2-h3v6-rqpq SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

• Go github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260803045322-cb67e0b4fab5 → fixed in 0.0.0-20260803045322-cb67e0b4fab5

High Package gomod `github.com/siyuan-note/siyuan/kernel` Affected versions 3.7.3 Patched versions *(none yet — leave blank until a fix is released)* Description Summary `/ws/network/proxy` is an admin-only WebSocket forward-proxy endpoint (target URL and headers fully attacker-specifiable via query parameters). Its `websocket.Upgrader` explicitly overrides `CheckOrigin` to unconditionally return `true` — disabling the origin validation that the `gorilla/websocket` library otherwise enforces by default. WebSocket handshake requests are not subject to CORS preflight at all (unlike `fetch`/XHR), so origin validation for WebSocket endpoints has to be done deliberately by the server; here it has been deliberately turned *off* instead. Combined with the endpoint's own query-parameter-driven proxy target, this is a textbook Cross-Site WebSocket Hijacking (CSWSH) primitive on a capability that amounts to an authenticated network pivot through the SiYuan kernel process. Details ```go // kernel/api/network.go:501 upgrader := websocket.Upgrader{ CheckOrigin: func(r *http.Request) bool { return true }, } clientConn, upgradeErr := upgrader.Upgrade(c.Writer, c.Request, upgradeHeaders) ``` Route registration (admin-role-gated): ```go // kernel/api/router.go:614 ginServer.Handle("GET", "/ws/network/proxy", model.CheckAuth, model.CheckAdminRole, wsProxy) ``` The proxy target is fully attacker-controllable via query parameters, decoded and dialed directly: ```go // kernel/api/network.go:348 func parseForwardProxyParams(c *gin.Context) (parsedURL *url.URL, headers *http.Header, timeout time.Duration, err error) { uParam := c.Query("u") ... uBytes, decErr := base64.RawURLEncoding.DecodeString(uParam) ... parsedURL, err = url.ParseRequestURI(string(uBytes)) ... hParam := c.Query("h") // optional forwarded headers, also base64-encoded ``` A malicious webpage can construct, entirely from JavaScript with no special access: ```js new WebSocket("ws://127.0.0.1:6806/ws/network/proxy?u=" + base64url(attackerChosenTargetURL)); ``` WebSocket handshake requests are GET requests carrying ambient cookies exactly like any other cross-site navigation, and are not covered by CORS preflight protections at all, this is a distinct attack surface from ordinary `fetch`/XHR-based CSRF, and easy to overlook precisely because the usual CORS mental model doesn't apply to it. Whether this is currently exploitable in a given browser depends on the same session-cookie `SameSite` configuration already covered by a separate report on this repository (no explicit `SameSite` is set on the session cookie), but even where that provides incidental protection today, the explicit `CheckOrigin: func(r *http.Request) bool { return true }` override removes a defense-in-depth layer that would otherwise exist automatically from the WebSocket library's own safe default, and is worth fixing independently of the cookie-attribute question. Impact If reachable (dependent on browser/cookie-attribute behavior at time of exploitation, as above), a malicious website visited by a user with an active, admin-privileged SiYuan session could open a WebSocket connection to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to an attacker-chosen target, effectively an authenticated SSRF/network-pivot primitive, using the victim's own machine and any network position it has (e.g., internal/localhost-only services on the victim's LAN that aren't reachable from the public internet), entirely via a drive-by visit to an unrelated website while SiYuan happens to be running. PoC No live browser PoC was run for this report, this is a code-level confirmation that the `CheckOrigin` override exists and unconditionally returns `true`, combined with tracing the fully attacker-controlled proxy-target construction. I also checked whether the other WebSocket-adjacent endpoints (`/ws/plugin/rpc`, `/ws/broadcast`) share this issue: they use a different WebSocket library (`gws`, not `gorilla/websocket`) with a different upgrade code path I have not independently verified for its own origin-checking defaults, flagging this as worth a follow-up check by your team rather than claiming it applies there too. ``` Affected products | Field | Value | |---|---| | Ecosystem | Go | | Package name | `github.com/siyuan-note/siyuan/kernel` | | Affected versions | `<= 3.7.3` (confirmed present in 3.7.3; maintainers should confirm lower bound) | | Patched versions | *(none yet — leave blank until a fix is released)* | Severity | Field | Value | |---|---| | Vector string | `CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:N` | | Score | 5.5 (Medium), reflecting that real-world exploitability depends on the co-occurring session-cookie `SameSite` question (also separately reported) and requires a victim with an active admin session to visit an attacker-controlled page (`AC:H`, `UI:R`); I'd expect this to be scored higher by your team if you determine the cookie/browser-behavior precondition is reliably met, since the underlying capability (network pivot through the kernel process) is significant. | Weaknesses (CWE) • CWE-346 — Origin Validation Error (primary — this is the textbook CWE for CSWSH) • CWE-352 — Cross-Site Request Forgery (the broader category this specific WebSocket variant falls under) • CWE-918 — Server-Side Request Forgery (secondary — the resulting capability once a connection is hijacked) - ``` Suggested Fix Replace `CheckOrigin: func(r *http.Request) bool { return true }` with a real check — validate the `Origin` header against the expected local/loopback origin (or the configured workspace's own address), mirroring how `IsLoopbackCallback`-style validation is already done correctly elsewhere in this codebase (e.g. the MCP OAuth client's loopback-callback check). Also worth auditing the `gws`-based WebSocket endpoints (`/ws/plugin/rpc`, `/ws/broadcast`) for their own origin-validation defaults, since I did not verify those independently.