SiYuan kernel versions prior to 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint. The vulnerability arises because the endpoint explicitly disables origin validation by setting the CheckOrigin function to unconditionally return true. This allows attackers to craft malicious webpages that establish WebSocket connections to this endpoint. Once connected, attackers can direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, effectively enabling authenticated network pivoting through the victim's machine. The advisory is a duplicate of GHSA-3cc2-h3v6-rqpq and has been withdrawn to preserve external references.

An attacker can exploit this vulnerability to bypass origin checks and establish WebSocket connections to the admin-only network proxy endpoint. This enables the attacker to proxy arbitrary network traffic through the victim's machine with the privileges of the SiYuan kernel process, potentially allowing network pivoting and access to internal network resources. The CVSS score is 8.2, indicating a high severity impact on confidentiality with limited integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory GHSA-3cc2-h3v6-rqpq for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for patch availability and mitigation steps.