Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260813142104-b26a4a307b8a | 0.0.0-20260813142104-b26a4a307b8a |
Miggo AIRoot Cause AnalysisThe vulnerability GHSA-p23f-cm6q-2qp8, titled 'SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)', stems from insufficient path validation within the SiYuan application. The core issue lies in the asset.assetUpload function (located in kernel/mcp/tools/asset.go), which accepts a list of absolute file paths from user input (potentially via prompt injection to an AI agent). In the vulnerable version, this function would normalize these paths using filepath.Abs but failed to perform any security-critical boundary checks, such as verifying if the paths were within the designated workspace or if they pointed to sensitive system files. This allowed an attacker to specify paths like /etc/passwd or ~/.ssh/id_rsa.
Subsequently, the model.InsertLocalAssets function (located in kernel/model/upload.go) is called to process these paths. This function is responsible for opening and copying the contents of the specified files into the workspace's assets/ directory. The vulnerability description explicitly states that InsertLocalAssets also lacked proper security-oriented boundary checks; an existing IsSubPath check was merely for deduplication and did not prevent reading files outside the intended workspace. Therefore, the combination of asset.assetUpload accepting arbitrary paths and model.InsertLocalAssets directly acting upon them without sufficient validation created a critical arbitrary file read vulnerability. An attacker could exploit this by inducing the AI agent to call asset.upload with malicious file paths, leading to sensitive files being copied into the workspace and subsequently exfiltrated.
asset.assetUploadkernel/mcp/tools/asset.go
model.InsertLocalAssetskernel/model/upload.go
IsSensitivePathmodel.InsertLocalAssetskernel/model/upload.go:97os.Openassets/Every other AI-plane file primitive in SiYuan is workspace-constrained:
file / unzip tools resolve paths via resolvePath (workspace-relative, escape-proof).asset.upload is the only AI tool that accepts arbitrary absolute paths with zero boundary validation. An attacker who can steer the Agent (prompt injection) can induce it to upload sensitive files — e.g. /Users/victim/.ssh/id_rsa, ~/.aws/credentials, /etc/passwd — into the workspace, from where they are reachable via notes / export / sync.
CheckAdminRole on /mcp and adding refuseToAccess for conf/conf.json in the file tool. However, the asset.upload tool was never given a workspace boundary check — it still accepts and reads any absolute path. This is a residual boundary omission from that remediation: the admin gate restricts who may call MCP, but does not constrain which files asset.upload may read. We report it as the unpatched half of the MCP file-surface hardening.Statically confirmed on the latest release v3.8.0 (tag v3.8.0, commit 251596fc0):
kernel/mcp/tools/asset.go:195 assetUpload: abs, _ := filepath.Abs(strings.TrimSpace(f)) — normalization only.kernel/model/upload.go:97 InsertLocalAssets: iterates the path list and os.Open(assetAbsPath) → writeAssetFile(writePath, ...) into assetsDirPath; the IsSubPath(assetsDirPath, assetAbsPath) check at line 130 is only a dedup guard, not a boundary limit. No workspace/external restriction is applied.kernel/mcp/tools/asset.go:195 — assetUpload (files arg → filepath.Abs only).kernel/model/upload.go:97 — InsertLocalAssets (os.Open + copy to assets/).kernel/mcp/tools/unzip.go:52 unzipHandler uses resolvePath (workspace-relative, escape-proof).AI Agent / prompt injection. Victim lets the Agent process attacker-controlled web/note content → agent is induced to call asset.upload with /Users/victim/.ssh/id_rsa (or similar) as a files entry. The user sees a category-level confirmation ("upload asset") that does not display the specific source path, so the approval is effectively blind to the actual file being read. Once approved, the file is copied into the workspace and exfiltrated via notes/export/sync. No admin role is required beyond the existing Agent/MCP configuration.
// Agent tool call (asset.upload), attacker-influenced files argument:
{
"id": "<someBlockID>",
"files": "/Users/victim/.ssh/id_rsa,/Users/victim/.aws/credentials,/etc/passwd"
}
Handler flow:
filepath.Abs("/Users/victim/.ssh/id_rsa") → /Users/victim/.ssh/id_rsa (no IsSubPath/IsSensitivePath rejection).InsertLocalAssets → os.Open → bytes copied into <workspace>/data/assets/....Confidentiality breach: arbitrary local file read (including SSH keys, cloud credentials, OS secrets) through the AI plane. Integrity/availability not directly impacted. Severity is moderated by the required user approval step, but the approval dialog does not reveal the real source path, so the user cannot make an informed decision.
Reachable only when the Agent/MCP surface is configured and the user approves the upload action. The boundary check is absent regardless of config — any approved upload reads outside the workspace.
assetUpload: reject any entry where !util.IsSubPath(util.WorkspaceDir, abs) or util.IsSensitivePath(abs) (same checks used elsewhere).LocalWrite gate is action-category based and hides the specific path).resolvePath workspace-relative constraint already applied to the file / unzip tools.Note: patch authored against v3.8.0 source; not compiled into a full SiYuan release build. Provided for the maintainer to validate in CI.
diff --git a/kernel/mcp/tools/asset.go b/kernel/mcp/tools/asset.go
index aaa..bbb 100644
--- a/kernel/mcp/tools/asset.go
+++ b/kernel/mcp/tools/asset.go
@@ -195,8 +195,16 @@ func assetUpload(args map[string]any) (CallToolResult, error) {
fileList := strings.Split(filesStr, ",")
for i, f := range fileList {
abs, err := filepath.Abs(strings.TrimSpace(f))
- if err != nil {
+ if err != nil {
return CallToolResult{}, err
}
+ // 边界校验：仅允许工作区内的资产，拒绝任意绝对路径越界读
+ if !util.IsSubPath(util.WorkspaceDir, abs) || util.IsSensitivePath(abs) {
+ ret.Code = -1
+ ret.Msg = fmt.Sprintf("asset path %s is outside the workspace or sensitive", abs)
+ return CallToolResult{}, fmt.Errorf("asset path outside workspace: %s", abs)
+ }
fileList[i] = abs
}
succMap, err := model.InsertLocalAssets(id, fileList, true)