Unauthenticated Debug Endpoints Expose In-Memory Secrets

SiYuan is a popular open-source note-taking application that, prior to version 3.7.4, inadvertently exposed Go runtime debugging endpoints through its net/http/pprof interface. When the application runs without the --mode flag explicitly set to 'prod', these debug endpoints (/debug/pprof/heap, /debug/pprof/goroutine, etc.) become accessible without authentication. This creates a critical vulnerability because attackers can remotely access heap dumps and memory snapshots containing highly sensitive data such as authentication codes, session tokens, and API keys for AI providers. Organizations running SiYuan instances—particularly those using it for documentation, knowledge management, or development—face immediate risk of credential compromise and lateral movement attacks if exposed to untrusted networks.

While this CVE lacks direct MITRE ATT&CK technique mapping, Casky's skill-based detection framework would identify the attack patterns within the broader reconnaissance and credential access kill chains. Practitioners using Casky would observe alerts related to suspicious HTTP requests to debug endpoints, unauthenticated access to memory inspection tools, and extraction of sensitive strings from process memory. The platform's extended reasoning capabilities—leveraging Claude AI across 754 mapped security skills—would correlate unusual /debug/pprof requests with subsequent API key usage or authentication anomalies, surfacing this as a high-priority finding. Organizations would receive actionable guidance on detecting when attackers probe for unprotected debug interfaces and exfiltrate in-memory secrets, enabling rapid containment before credentials are weaponized.