CVE-2023-27035
Published: 01 May 2023
Summary
CVE-2023-27035 is a medium-severity Incorrect Default Permissions (CWE-276) vulnerability in Obsidian Obsidian. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 7.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Obsidian Canvas version 1.1.9 contains an improper default permissions issue (CWE-276) that permits embedded websites on a canvas page to invoke sensitive browser APIs without explicit user consent. The affected component is the canvas rendering engine in the Obsidian note-taking application, which loads third-party web content directly into the desktop client.
An attacker who can supply or control an embedded web page can trigger desktop notifications, access the microphone for audio recording, and exercise other unspecified web APIs simply by having the victim open the malicious canvas. The attack requires the victim to load the crafted note but needs no additional privileges or interaction beyond rendering the page, corresponding to the CVSS vector AV:N/AC:L/PR:N/UI:R.
Forum advisories and the subsequent Obsidian release v1.1.14 insider build address the issue by tightening permission handling for embedded web content. A public proof-of-concept is available on GitHub that demonstrates the API abuse.
EPSS for the vulnerability rose from lower values to a peak of 0.2690 before receding to the current 0.0884, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30824
Vulnerability details
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Access control policy can specify and enforce secure default permissions for resources.
Guides setting of default permissions to the minimum required level.
Establishes requirements for appropriate default permissions on system resources as part of configuration management.
Baseline establishment and updates on install/upgrade ensure correct default permissions rather than insecure ones.
Requiring the most restrictive settings instead of defaults prevents incorrect default permissions on resources.
Requires documented processes that include setting and maintaining correct default permissions for configuration items.
Requires addressing secure default permissions in physical and environmental protection controls.
Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.