A critical SSRF vulnerability in SiYuan versions prior to 3.6.0 allows authenticated attackers to perform unauthorized requests against internal networks and cloud metadata services.

The /api/network/forwardProxy endpoint fails to perform adequate URL validation, enabling an authenticated user to force the server to issue arbitrary HTTP requests. This flaw allows attackers to probe internal network infrastructure, interact with local services, or access sensitive cloud metadata endpoints.

This vulnerability poses a significant risk to internal network security. By leveraging the server as a proxy, an attacker can bypass perimeter firewalls to access internal-only services or steal credentials from cloud environment metadata, potentially leading to full system compromise or lateral movement. The CVSS score of 8.3 reflects the high potential for impact on confidentiality and integrity within the host environment.

Immediate Action: Update SiYuan to version 3.6.0 or later to apply the necessary URL validation logic.

Proactive Monitoring: Review web access logs for unusual patterns or requests originating from the /api/network/forwardProxy endpoint.

Compensating Controls: Implement strict egress filtering on the server to prevent it from initiating unauthorized connections to internal network segments or sensitive metadata IP addresses.

Public Exploit Available: No

Given the potential for internal network reconnaissance and cloud resource exploitation, organizations should prioritize upgrading to version 3.6.0 immediately. If an immediate update is not feasible, restrict access to the affected API endpoint or implement strict network-level egress controls to limit the scope of potential SSRF abuse.