GitHub Advisoryadvisory · Go

GHSA-4pjc-pwgq-q9jp SiYuan has an SSTI via /api/template/renderSprig

MEDIUM Published 2024-12-11 Modified 2024-12-12 Official page ↗
Aliases
CVE-2024-55660
Ecosystem
Go
Packages
github.com/siyuan-note/siyuan/kernel
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-1336
Reviewed
2024-12-11

Affected packages

• Go github.com/siyuan-note/siyuan/kernel: <= 0.0.0-20241210012039-5129ad926a21 (no fix yet)

Description

Summary Siyuan's /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables Impact Information leakage

Related

Alias · CVE (1)

  • CVE-2024-55660 SiYuan is a personal knowledge management system. vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References