CVE-2026-74802 in SiYuan
Summary
by MITRE • 08/17/2026
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in SiYuan versions prior to 3.7.4 represents a critical failure in access control and input validation within the application’s WebSocket handling mechanism. Specifically, the flaw resides in the admin-only endpoint located at /ws/network/proxy. This endpoint is designed to facilitate network proxying operations but contains a severe implementation error where origin validation is explicitly disabled. The underlying code sets the CheckOrigin function to unconditionally return true, thereby bypassing standard browser security policies that rely on the Origin header to prevent cross-site request forgery and unauthorized access from different domains. By removing this check, the application fails to verify whether incoming WebSocket connections originate from a trusted source or are being initiated by malicious third-party websites loaded in the victim’s browser context.
This architectural flaw enables Cross-Site WebSocket Hijacking, a variant of CSRF that targets persistent bidirectional communication channels rather than simple HTTP requests. An attacker can craft a malicious webpage containing JavaScript code designed to establish a WebSocket connection directly to the SiYuan application’s proxy endpoint on behalf of an authenticated user. Because the server does not validate the origin of these connections, it accepts and processes them as legitimate administrative commands. This allows the attacker to leverage the victim’s active session privileges without requiring additional authentication steps such as passwords or multi-factor verification. The attack vector relies entirely on social engineering or drive-by techniques to get a privileged user to visit the malicious site while their SiYuan instance is running with an active login session.
The operational impact of this vulnerability is significant, primarily due to its ability to facilitate authenticated network pivoting through the victim’s machine. Once the WebSocket connection is established and accepted by the vulnerable endpoint, the attacker gains the ability to direct the SiYuan kernel process to proxy arbitrary network traffic to targets chosen by the adversary. This effectively turns the user’s workstation into a relay node for malicious activities. The implications extend beyond simple data exfiltration; attackers can use this pivot point to scan internal networks that are not directly accessible from the internet, access sensitive intranet services, or conduct further attacks against other systems within the victim’s network perimeter. This capability severely compromises the integrity and confidentiality of both local resources and connected enterprise environments.
From a classification perspective, this vulnerability aligns with CWE-942, which describes Cross-Site WebSocket Hijacking, as well as CWE-352 regarding Cross-Site Request Forgery where origin validation is improperly implemented or disabled. In terms of the MITRE ATT&CK framework, this exploit maps to T1071 Application Layer Protocol for command and control communication and potentially T1564 Hidden Files and Directories if used to obscure activity, though its primary utility lies in lateral movement via network pivoting. The lack of origin validation is a fundamental security anti-pattern that violates the principle of least privilege by allowing untrusted origins to execute administrative functions.
Mitigation strategies must focus on restoring strict origin validation for all WebSocket endpoints, particularly those with elevated privileges. Developers should configure the CheckOrigin function to explicitly verify that the Origin header matches an allowlist of trusted domains rather than returning true indiscriminately. Additionally implementing SameSite cookie attributes and utilizing anti-CSRF tokens can provide defense-in-depth layers against such hijacking attempts. For users currently running affected versions, upgrading to SiYuan version 3.7.4 or later is essential as this release addresses the flawed origin checking logic. Until an upgrade is performed, restricting access to the application through network segmentation and ensuring that no untrusted content can be loaded in browsers where SiYuan sessions are active may reduce exposure risk.