CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Vulnerability type: Incorrect Access Control Description: An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the...

TJ-OPT

TJ-OPT Release Date September 9th 2024 Introduction As a pentester, there are many great resources, cheat sheets, and guidelines that contain a large amount of valuable information. However, it can be frustrating and time-consuming to find these notes or resources that are scattered all over the...

obsidian-note-toolbar-PoC

Frontmatter-Driven Arbitrary Code Execution in Note Toolbar via propNAME → js: Variable Chain CVE status: requested, pending assignment. This finding is published as GHSA-q8cw-3m8c-5pf2. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-obsidian-note-toolbar-PoC and this banner is...

obsidian-osint-templates

obsidian-osint-templates !info License Copyright c 2024 Micah Hoffman This work is licensed under the Creative Commons Attribution-ShareAlike 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/4.0/ or send a letter to Creative Commons, PO Bo...

CVE-2021-45007

CVE-2021-45007 Cross-Site Request Forgery Affected product and version: Plesk Obsidian 18.0.37 Severity: High Impact: Submit requests with attacker information Description: CSRF could let the attacker to submit new requests because there isn’t any CSRFtoken protection sent with requests to server...

CVE-2021-45008

CVE-2021-45008 Privilege Escalation from user to admin Affected product and version: Plesk Obsidian 18.0.37 Severity: Critical Impact: Gain high privilege from user to admin and access critical information Description: insecure permissions vulnerability that allows unprivilege user to get admin...

supernote-obsidian-plugin-PoC

Summary CVE status: requested, pending assignment. This finding is published as GHSA-3gx3-r874-5pp4. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-supernote-obsidian-plugin-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

CVE-2024-3094

CVE-2024-3094 I've moved my notes in Obsidian to a separate vault and this GitHub repository to be able to share it. The start page is CVE-2024-3094 xz supply chain. Installation Clone the repo with git. git clone https://github.com/reuteras/CVE-2024-3094.git Then open the checked out folder as a...

Authorization Bypass

obsidian-tc is vulnerable to authorization bypass. The vulnerability is due to insufficient validation of the caller-controlled vault identifier, missing vault binding in JWTs, and globally shared folder access controls, which allows an attacker with a valid token to read, modify, or delete...

Missing Origin Validation

obsidian-tc is vulnerable to missing Origin and DNS-rebinding validation. The vulnerability is due to missing Host, Origin, and DNS-rebinding validation in the Streamable HTTP transport when authentication is disabled, which allows an attacker to exploit a malicious webpage to gain unrestricted...

Obsidian-tc HTTP Transport Lacks Origin/DNS-rebinding Protection, Enabling Drive-by Vault Access On Loopback

Impact The Streamable HTTP transport was constructed without "enableDnsRebindingProtection"/"allowedHosts"/"allowedOrigins" and performed no "Origin"-header validation. With the documented "auth.mode: "none"" loopback default, a drive-by web page could "POST http://127.0.0.1/mcp" and receive call...

Obsidian-tc: Default Folder ACL Is Fail-open; .obsidian Plugin Secrets Are Readable By Default

Impact With a default configuration, an undefined "readPaths"/"writePaths" meant allow-all, the "strictReadDefault" flag was inert, and the ".obsidian"/".git"/".trash" control directories were denied only during enumeration — not on the direct request path. A caller could read...

Obsidian-tc : Symlink Read-ACL Scope Bypass Via Lexical Path Checks

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink no M...

Obsidian-tc Tokens Can Access Arbitrary Configured Vaults

Impact Tool dispatch did not check the caller-supplied "input.vault" against the caller's bound vault "ctx.vaultId"; the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing...

Obsidian-tc Bridge Tools Leak Denied-note Data Via Unfiltered Sibling Fields

Impact Bridge tool results filtered only the "items" array against the read ACL and passed sibling fields through unfiltered: "tasksfilter" emitted "groups" whose counts reflected denied notes, "makemdquery" returned "...result" siblings, and "listtemplates" enumerated Templater template paths an...

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Summary createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes vulnerability discovered by ? in WordPress npm obsidian-tc versions = 1.0.1, = 1.31.3...

GHSA-R3G7-R4HR-M258 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Summary createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-loca...