CVE-2023-2110
📋 TL;DR
This vulnerability in Obsidian desktop allows malicious webpages or markdown files to access local files through improper path handling. Attackers can exfiltrate sensitive files to remote servers using the 'app://local/' URI scheme. Users who open malicious markdown files or paste content from malicious webpages into Obsidian are affected.
💻 Affected Systems
- Obsidian desktop
📦 What is this software?
Obsidian by Obsidian
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive local files including credentials, personal documents, and system files, with exfiltration to attacker-controlled servers.
Likely Case
Targeted theft of specific sensitive files from users' computers through social engineering attacks.
If Mitigated
No impact if users avoid opening untrusted markdown files and don't paste content from untrusted web sources.
🎯 Exploit Status
Exploitation requires user interaction but is technically simple. Proof of concept available in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.8 and later
Vendor Advisory: https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/
Restart Required: Yes
Instructions:
1. Open Obsidian. 2. Go to Settings > About. 3. Check for updates. 4. Install version 1.2.8 or later. 5. Restart Obsidian.
🔧 Temporary Workarounds
Disable automatic updates check
allTemporarily disable automatic checking for updates to prevent potential exploitation through update mechanisms
Settings > About > Disable 'Automatically check for updates'
🧯 If You Can't Patch
- Avoid opening markdown files from untrusted sources
- Do not copy and paste content from untrusted webpages into Obsidian
🔍 How to Verify
Check if Vulnerable:
Check Obsidian version in Settings > About. If version is below 1.2.8, you are vulnerable.Check Version:
Obsidian Settings > About shows version numberVerify Fix Applied:
Verify version is 1.2.8 or higher in Settings > About.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns through app://local/ URIs
- Network connections to suspicious domains after file access
Network Indicators:
- Outbound connections to unknown servers following local file access
SIEM Query:
source="obsidian" AND (uri="app://local/*" OR destination_ip="suspicious_ip")