Remote Code Execution and User Privacy Issues in Obsidian Canvas by Obsidian
CVE-2023-27035

7.5HIGH

Key Information:

Vendor

Obsidian

Status
Obsidian
Vendor
CVE Published:
1 May 2023

Badges

👾 Exploit Exists

What is CVE-2023-27035?

A security flaw in Obsidian Canvas version 1.1.9 allows external attackers to exploit the application through embedded web pages. This vulnerability enables remote users to send unsolicited notifications to the desktop and potentially record user audio without consent. The exploitation occurs via sensitive web APIs that can be accessed inadvertently when users interact with external content on the canvas page. This raises significant concerns regarding user confidentiality and the potential for unauthorized access to sensitive information.

References

https://forum.obsidian.md/t/embedded-web-pages-in-obsidia...
https://forum.obsidian.md/t/obsidian-release-v1-1-14-insi...
https://github.com/fivex3/CVE-2023-27035

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.