Executive brief
Obsidian is a popular note-taking application that lets users click links within their notes. Before version 0.12.12, clicking a link that used a non-standard protocol (anything other than http:// or https://) would be executed immediately without warning the user. This could allow an attacker who tricks a user into opening a malicious note or link to launch other applications or handlers on the victim's machine without their explicit consent, potentially leading to further compromise.
Technical details
The vulnerability is an improper authorization/missing confirmation issue (CWE-285) in Obsidian's link-handling logic prior to version 0.12.12. When a user clicked a link using a non-http/https protocol (e.g., custom URI schemes registered by other applications), Obsidian would invoke the handler without prompting the user, unlike its behavior for standard web links. Exploitation requires user interaction (opening a note containing a malicious link or a shared vault) but no authentication to the app itself; the attack vector is local/client-side rather than direct network exploitation of the app. Impact depends on what protocol handlers are registered on the victim's system, potentially enabling launch of other applications, command execution via vulnerable custom URI handlers, or information disclosure. The fix, shipped in Obsidian 0.12.12 (August 2021), adds a confirmation dialog for non-standard protocol links with a per-protocol opt-out for future prompts.
Affected products
- Obsidian obsidian (npm package / desktop app) < 0.12.12
Timeline
- 2021-08-03: patched: Fixed in Obsidian release v0.12.12
- 2021-08-07: disclosed: CVE-2021-38148 published on NVD
- 2022-05-24: advisory: GHSA-45mx-g85m-wwm3 published on GitHub Advisory Database