A high-severity server-side request forgery vulnerability in SiYuan before version 3.8.1 allows unauthenticated attackers to access sensitive internal network services and cloud metadata.

This vulnerability is a time-of-check to time-of-use (TOCTOU) flaw in the http_request and web_fetch tools, which perform DNS resolution only during the initial guard check. An unauthenticated attacker can leverage DNS rebinding to substitute a public IP with a private or cloud metadata IP after the initial validation, successfully bypassing SSRF protections.

Successful exploitation allows unauthorized access to internal services or cloud instance metadata, potentially leading to the theft of credentials, environment configuration data, or internal system compromise. With a CVSS score of 8.2, this high-severity flaw poses a significant risk to the confidentiality of infrastructure residing within the same network as the SiYuan application.

Immediate Action: Update the SiYuan installation to version 3.8.1 or later to implement proper validation at the connect-time stage.

Proactive Monitoring: Inspect server logs for unusual outbound requests originating from the SiYuan application to internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Deploy or configure a Web Application Firewall (WAF) to restrict outbound traffic from the application server to internal IP address ranges and sensitive metadata services.

Public Exploit Available: Unknown

Given the potential for unauthorized data access and the high CVSS severity, administrators should prioritize updating to version 3.8.1 immediately. If an immediate update is not feasible, restrict the network reachability of the SiYuan host to prevent it from communicating with internal infrastructure or sensitive cloud metadata services.