SiYuan WebSocket Origin Validation Bypass Enables Network Pivoting

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SiYuan versions before 3.7.4 contain a critical cross-site WebSocket hijacking (CSWSH) vulnerability in its admin-only /ws/network/proxy endpoint. By explicitly disabling origin validation through an unconditional CheckOrigin return of true, the vulnerability allows attackers to establish unauthorized WebSocket connections from malicious webpages. This is particularly dangerous because it enables authenticated network pivoting—attackers can leverage a compromised or socially engineered admin to proxy arbitrary network traffic through the victim's SiYuan kernel process to attacker-controlled targets. Organizations relying on SiYuan for note-taking and knowledge management face potential lateral movement risks, data exfiltration, and internal network reconnaissance, especially in environments where SiYuan runs with elevated privileges or network access.

Casky's 322 matching skills detect the attack patterns behind this vulnerability by correlating MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Using Claude AI's extended reasoning capabilities, practitioners will identify findings related to: (1) suspicious WebSocket connection attempts to /ws/network/proxy from unexpected origins, indicating potential CSWSH exploitation; (2) unusual outbound proxy traffic initiated through the SiYuan kernel process to non-standard targets, revealing network pivoting attempts; and (3) admin session hijacking patterns where legitimate credentials are abused for unauthorized network access. The skill set enables detection of the origin validation bypass technique itself, allowing security teams to spot malformed or missing origin headers, unconditional access grants, and anomalous traffic patterns that deviate from normal SiYuan administrative operations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-74802.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-74802

Casky has 322 skills that investigate the attack patterns behind CVE-2026-74802. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn