SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON. A remote attacker can send malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service. Version 3.6.2 fixes the issue.

Affected: Go: github.com/siyuan-note/siyuan/kernel

## Summary The SiYuan kernel WebSocket server accepts unauthenticated connections when a specific “auth keepalive” query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON.

A remote attacker can send malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service.

## Details **1. Authentication Bypass via Keepalive Query**

Unauthenticated connections are accepted if the request URI matches a specific pattern intended for an authentication page keepalive.

**File: kernel/server/serve.go**

``` if !authOk { authOk = strings.Contains(s.Request.RequestURI, "/ws?app=siyuan") && strings.Contains(s.Request.RequestURI, "&id=auth&type=auth") }

```

**2. Unsafe Type Assertions on Untrusted Input**

Incoming JSON messages are parsed into a generic map and fields are accessed without validation.

**File: kernel/server/serve.go**

``` cmdStr := request["cmd"].(string) cmdId := request["reqId"].(float64) param := request["param"].(map[string]interface{})

``` Malformed or missing fields trigger a runtime panic. The handler does not implement local panic recovery, allowing crashes to propagate.

## PoC **Step 1 — Prepare workspace directory**

```sh mkdir -p ./workspace ```

**Step 2 — Run SiYuan container**

``` docker run -d \ -p 6806:6806 \ -e SIYUAN_ACCESS_AUTH_CODE_BYPASS=true \ -v $(pwd)/workspace:/siyuan/workspace \ b3log…