CVE-2026-66012: SiYuan missing authorization in /mcp enables unauthenticated administrator takeover via Publish proxy

SiYuan versions before 3.7.2 expose the management-grade MCP endpoint through the Publish reverse proxy when Publish is enabled in anonymous mode. An unauthenticated remote HTTP client can POST to /mcp on the Publish port, obtain an MCP session, and invoke the built-in file tool. That tool can read and write workspace files, including conf/conf.json and plugin configuration under data/plugins and data/storage/petal. In this run the unauthenticated MCP write primitive is chained into code execution by planting a desktop plugin in the workspace, restarting/launching the real SiYuan Electron desktop runtime under Xvfb, and capturing attacker-controlled id command output from the plugin's renderer-side JavaScript.

• Package/component affected: SiYuan kernel MCP service, Publish reverse proxy, workspace file tooling, and desktop plugin loader.
• Affected versions: Before 3.7.2. The reproduction uses vulnerable v3.7.1 and fixed v3.7.2.
• Risk level and consequences: Critical. With Publish anonymous mode enabled and reachable, an unauthenticated remote attacker can use /mcp to read workspace files, exfiltrate conf/conf.json, write arbitrary workspace files, plant plugins, and obtain command execution when the real desktop/Electron runtime next loads the planted plugin. Publish authentication enabled or v3.7.2 blocks the unauthenticated /mcp path.

Impact Parity

• Disclosed/claimed maximum impact: Unauthenticated administrator takeover / code execution through Publish-proxied /mcp, with workspace file read/write, secret exfiltration, plugin planting, and execution on next desktop launch.
• Reproduced impact from this run: Full unauthenticated HTTP access to /mcp through the Publish reverse proxy on v3.7.1; unauthorized file write/read; conf/conf.json exfiltration; plugin files and petals.json planted using the same unauthenticated /mcp session; real SiYuan Electron desktop launched under Xvfb; planted plugin executes attacker-controlled JavaScript with Node/Electron child_process access and writes a marker containing id output. Fixed v3.7.2 and Publish-auth-enabled controls reject the initial unauthenticated /mcp request and therefore block the planting path.
• Parity: full.
• Not demonstrated: Interactive administrator UI takeover is not separately demonstrated because the reproduced attacker-controlled command execution is a stronger concrete runtime effect than file-only takeover. The command executes as the SiYuan desktop user inside the tested Linux sandbox.

Root Cause

Before v3.7.2, the /mcp route was reachable after the Publish reverse proxy applied the anonymous Publish access context. The MCP server exposed tools that are equivalent to local/admin workspace management primitives, including arbitrary workspace file read/write. In anonymous Publish mode, the reverse proxy allowed unauthenticated clients to reach /mcp; the MCP handler accepted initialize and subsequent tools/call requests without enforcing an administrator role for this management surface. Because the file tool accepts attacker-controlled paths inside the workspace, an unauthenticated client can write plugin files under data/plugins/<name>/ and enable the plugin via data/storage/petal/petals.json.

The desktop plugin loader later loads enabled plugins from those workspace files. In the desktop renderer, SiYuan v3.7.1 creates BrowserWindows with nodeIntegration: true and contextIsolation: false; plugin JavaScript is evaluated via the plugin loader and can call Node/Electron modules. Therefore, a planted plugin can call require("child_process") and execute a local command when the real desktop application starts with that workspace.

The v3.7.2 fix adds authorization requirements to MCP. In the fixed source, the MCP routes are registered with model.CheckAuth, model.CheckAdminRole, and model.CheckReadonly, so Publish anonymous access no longer satisfies the admin requirement for /mcp. Public references include the advisory and fixed release/commit listed in the ticket: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cvhv-7xhj-xjp8 and SiYuan v3.7.2.

Reproduction Steps

1. Run bundle/repro/reproduction_steps.sh.
2. The script reuses or creates the SiYuan checkout in the prepared project cache, builds the real v3.7.1 and v3.7.2 kernels, ensures the real v3.7.1 Linux desktop release is available, starts the vulnerable v3.7.1 kernel with Publish anonymous mode enabled, and sends HTTP requests to POST /mcp through the real Publish reverse proxy at 127.0.0.1:6808.
3. The script obtains an unauthenticated MCP session, writes and reads pwned.txt, exfiltrates conf/conf.json, plants a desktop plugin and petals.json via the MCP file tool, stops the kernel, and launches the real SiYuan Electron desktop under Xvfb with the same workspace. The plugin writes a marker containing id output to bundle/logs/repro/desktop-rce-marker.log.
4. The script also runs negative controls: v3.7.1 with Publish auth enabled rejects unauthenticated /mcp, and v3.7.2 with anonymous Publish rejects the initial /mcp request before any plugin planting can occur.

Expected evidence is a successful script exit, vulnerable /mcp response logs containing file written, owned by unauthenticated mcp, and kernelVersion, the desktop marker containing PRUVA_MCP_DESKTOP_RCE plus uid=..., and fixed/auth-control logs showing HTTP 401/403 style rejection of unauthenticated /mcp.

Evidence

The reproduction script writes all runtime-backed evidence under bundle/logs/repro/ and records the proof artifacts in bundle/repro/runtime_manifest.json. Key artifacts include:

• bundle/logs/repro/mcp-init-response.log — unauthenticated POST /mcp initialize through the Publish reverse proxy returns HTTP 200 and Mcp-Session-Id on v3.7.1.
• bundle/logs/repro/mcp-write-response.log — MCP file tool writes pwned.txt as an unauthenticated attacker.
• bundle/logs/repro/mcp-read-response.log — MCP file tool reads back the attacker-controlled content.
• bundle/logs/repro/mcp-conf-response.log — MCP file tool reads conf/conf.json from the workspace.
• bundle/logs/repro/mcp-plugin-json-write-response.log, bundle/logs/repro/mcp-plugin-index-write-response.log, and bundle/logs/repro/mcp-petals-write-response.log — plugin planting performed through the same unauthenticated MCP session.
• bundle/logs/repro/siyuan-desktop-rce.log and bundle/logs/repro/siyuan-desktop-rce-app.log — real Electron desktop launch under Xvfb with the planted workspace.
• bundle/logs/repro/desktop-rce-marker.log — marker generated by attacker-planted plugin code, containing PRUVA_MCP_DESKTOP_RCE and id output.
• bundle/logs/repro/siyuan-vuln-auth.log and bundle/logs/repro/mcp-auth-control-response.log — Publish authentication enabled blocks unauthenticated /mcp.
• bundle/logs/repro/siyuan-fixed-anon.log and bundle/logs/repro/mcp-fixed-control-response.log — fixed v3.7.2 blocks the same unauthenticated /mcp request even with anonymous Publish enabled.

Environment details captured by the script include source tag/commit resolution, kernel build logs, real desktop release extraction, and runtime logs from the vulnerable and fixed kernels.

Recommendations / Next Steps

• Upgrade SiYuan to v3.7.2 or later.
• Keep Publish authentication enabled whenever Publish is exposed, and do not expose anonymous Publish to untrusted networks on affected versions.
• Treat /mcp and similar file/plugin/workspace management routes as local/admin-only surfaces. Require an authenticated administrator role before dispatching MCP methods or tools.
• Add regression tests that exercise /mcp through the Publish reverse proxy with anonymous Publish enabled, Publish auth enabled, and authenticated-admin contexts. The anonymous and non-admin cases must fail before MCP session creation and tool dispatch.
• Consider defense in depth for plugin loading: explicit trust prompts, safer defaults for bazaar.trust, and stronger separation between remote content exposure and local plugin execution.

Additional Notes

• The reproduction is idempotent: it uses fresh /tmp workspaces and marker paths, kills leftover SiYuan kernel/desktop processes before and after each attempt, and can be run repeatedly.
• The desktop code-execution proof requires Linux GUI dependencies and Xvfb because it launches the real Electron product path. The script installs required packages when absent and uses the real upstream SiYuan v3.7.1 Linux desktop tarball.
• The code-execution marker is generated only after the unauthenticated /mcp write primitive plants the plugin in the current run; it is not a pre-planted artifact.