CVE-2026-69083 Sumo Logic CSE · Sumo

Detect SiYuan fullTextSearchAssetContent Unauthenticated SQL Injection and REGEXP Injection (CVE-2026-69083) in Sumo Logic CSE

Detects exploitation of CVE-2026-69083, a CVSS 10.0 unauthenticated SQL injection and REGEXP injection in SiYuan's kernel (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260721004815-cf42dd5680c8. In publish (reader) mode the fullTextSearchAssetContent handler passes attacker-controlled input into raw SQL against a read-write asset-content SQLite database (method 2) and into an unescaped REGEXP operator (method 3). Because publish mode requires no authentication, an anonymous reader can execute arbitrary SQL and DoS/inject via crafted REGEXP patterns. Detection focuses on anomalous requests to the asset content full-text search API endpoint containing SQL/REGEXP injection markers, error responses indicating query manipulation, and SiYuan kernel process/DB access anomalies.

MITRE ATT&CK

Tactic
Initial Access Collection

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=web/access "fullTextSearchAssetContent"
| tolowercase(_raw) as lc
| where lc matches /union\s+select|sqlite_master|load_extension|attach\s+database|randomblob|pragma\s|regexp|;\s*--/
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| count by src_ip, _sourceHost
| sort by _count
critical severity medium confidence

Sumo Logic query surfacing SiYuan fullTextSearchAssetContent requests with SQL/REGEXP injection indicators for CVE-2026-69083.

Data Sources

Web access logsReverse proxy logs

Required Tables

web/access

False Positives & Tuning

  • Scanner-generated injection payloads
  • Legitimate content searches with SQL-like tokens
  • Authorized security assessments

Other platforms for CVE-2026-69083

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1UNION-based raw SQL injection (method 2)

    Expected signal: Web/proxy log entry to fullTextSearchAssetContent containing 'UNION SELECT' and 'sqlite_master'

  2. Test 2REGEXP injection (method 3)

    Expected signal: Request to endpoint containing 'REGEXP' with adversarial pattern; possible elevated response latency or 500 error

  3. Test 3sqlite_master enumeration probe

    Expected signal: HTTP POST to fullTextSearchAssetContent containing "' OR 1=1;--"

Last updated: 2026-09-04 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the targeted host runs SiYuan kernel (github.com/siyuan-note/siyuan/kernel) at a version below 0.0.0-20260721004815-cf42dd5680c8 and whether publish/reader mode is exposed unauthenticated.
  2. Extract the full request URI and body from the alerting event and identify which injection method is used: raw SQL (method 2, e.g. UNION SELECT / sqlite_master) or REGEXP injection (method 3, unescaped regexp pattern).
  3. Correlate the source IP's request history to determine if this is a single probe or sustained enumeration, and whether responses (HTTP 200 with data vs 500 errors) indicate successful exfiltration or DB errors.
  4. Check whether the SiYuan instance is internet-facing and how many reader-mode endpoints are reachable without authentication.

Containment

  1. Block the offending source IP(s) at the WAF/reverse proxy and rate-limit or disable the /api/search/fullTextSearchAssetContent endpoint until patched.
  2. Take the SiYuan publish/reader-mode surface offline or restrict it behind authentication/VPN until the kernel is upgraded to >= 0.0.0-20260721004815-cf42dd5680c8 (commit cf42dd5680c8).

Evidence Collection

  1. Preserve web/proxy and SiYuan kernel access logs capturing the full request URIs, bodies, timestamps, source IPs and user agents.
  2. Snapshot the asset-content SQLite database and kernel data directory to capture any modifications from the read-write DB exploited via method 2.

Escalation Criteria

  • !Escalate to incident response if responses indicate successful data exfiltration (query results returned) or evidence of write/modification to the asset-content database.
  • !Escalate to the application owner and CISO if the vulnerable instance is internet-facing and unauthenticated, given the CVSS 10.0 unauthenticated RCE-adjacent impact.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Web/reverse-proxy access logs containing fullTextSearchAssetContent requests with injection markers
  • >SiYuan kernel access and error logs
  • >Asset-content SQLite database files and their modification timestamps

Tuning Guidance

Baseline legitimate search traffic to the fullTextSearchAssetContent endpoint before enabling as a blocking rule; many benign searches will not contain SQL keywords. Tighten by requiring multiple distinct injection markers or an error/anomalous status code, and by scoping to internet-facing SiYuan hosts. Suppress known scanner source IPs and authorized pentest ranges.

Hunting Queries

Hunt for repeated injection-marker requests to the SiYuan asset-content search endpoint grouped by source IP over time.

Hunting — KQL
kql 
W3CIISLog | where csUriStem has "fullTextSearchAssetContent" | extend q=url_decode(coalesce(csUriQuery,"")) | where q has_any ("union","regexp","sqlite_master","pragma") | summarize count() by cIP, bin(TimeGenerated,1h)
Hunting — SPL
spl 
index=web uri="*fullTextSearchAssetContent*" | eval probe=lower(uri) | where match(probe,"union|regexp|sqlite_master|pragma") | stats count by src_ip

Atomic Red Team Tests

Test 1 UNION-based raw SQL injection (method 2)
linux

Send an unauthenticated request to the asset-content full-text search endpoint with a UNION SELECT payload against the read-write SQLite DB.

Command

bash 
curl -s 'http://siyuan.lab.local:6806/api/search/fullTextSearchAssetContent' -H 'Content-Type: application/json' -d '{"query":"x\" UNION SELECT name FROM sqlite_master--","types":{}}'

Cleanup

bash 
echo 'No persistent artifacts; clear web/kernel access logs if required for lab reset'

Expected Telemetry

Web/proxy log entry to fullTextSearchAssetContent containing 'UNION SELECT' and 'sqlite_master'

Expected Detection

KQL/SPL rules match on the injection markers in the request body/URI

Test 2 REGEXP injection (method 3)
linux

Submit a crafted REGEXP pattern that is passed unescaped into the query, triggering a catastrophic/ malformed regex condition.

Command

bash 
curl -s 'http://siyuan.lab.local:6806/api/search/fullTextSearchAssetContent' -H 'Content-Type: application/json' -d '{"query":"a REGEXP \"(a+)+$\"","types":{}}'

Cleanup

bash 
echo 'No cleanup required; restart kernel if DoS state persists'

Expected Telemetry

Request to endpoint containing 'REGEXP' with adversarial pattern; possible elevated response latency or 500 error

Expected Detection

Rules match on the 'regexp' marker in the request to the asset-content endpoint

Test 3 sqlite_master enumeration probe
windows

Probe the endpoint to enumerate database schema via injected sqlite_master reference.

Command

powershell 
powershell -Command "Invoke-WebRequest -Uri 'http://siyuan.lab.local:6806/api/search/fullTextSearchAssetContent' -Method POST -ContentType 'application/json' -Body '{\"query\":\"x'' OR 1=1;-- \",\"types\":{}}'"

Cleanup

powershell 
Remove-Item -ErrorAction SilentlyContinue .\response.json

Expected Telemetry

HTTP POST to fullTextSearchAssetContent containing "' OR 1=1;--"

Expected Detection

Detection rules match on the boolean/comment SQL injection markers

Related Detections

Tactic Hubs

TA0001Initial AccessTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1213Data from Information Repositories

Same Tactic: Initial Access

Popular Detections