Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the /api/bookmark/getBookmark endpoint, which is handled by the getBookmark function in kernel/api/bookmark.go. The core of the issue is an improper access control check. When a request is made to this endpoint in a read-only context (like a public, published document), the getBookmark function calls another function, model.FilterBlocksByPublishAccess, to filter out blocks the user should not see. However, it was passing nil as the request context to this function. The FilterBlocksByPublishAccess function, located in kernel/model/publish_access.go, was designed to interpret a nil context as a fully authorized request, thus skipping the password check for protected documents. This allowed any unauthenticated user to view bookmarked content within password-protected documents. The patch rectifies this by passing the actual request context (c *gin.Context) to FilterBlocksByPublishAccess, ensuring that proper authentication and authorization checks are performed.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | <= 3.6.1 | 3.6.2 |
