CVE-2023-38746/7: Two RCEs in Obsidian Desktop via Markdown and MathJax Bypass with POC

Vulnerability Overview Vulnerability Name: Two Remote Code Execution (RCE) vulnerabilities from Markdown to Shell in Obsidian Desktop CVE Identifiers: CVE-2023-38746 and CVE-2023-38747 Discoverer: Discovered by Codeliant security researchers Vulnerability Type: Remote Code Execution (RCE) Affected Software: Obsidian Desktop application Scope of Impact Affected Versions: Obsidian Desktop application Exploitation Methods: - Triggering RCE through specific syntax in Markdown files - Exploiting vulnerabilities in the Electron framework - Achieving RCE by bypassing MathJax's Safe Filter Remediation Mitigation Measures: - Update Obsidian Desktop to the latest version - Avoid opening Markdown files from untrusted sources - Enable security settings to restrict the execution permissions of Markdown files Proof of Concept (POC) Code RCE via Slides Plugin Markdown RCE via MathJax Safe Filter Bypass Disclosure Timeline 2023-06-15: Vulnerability report submitted 2023-06-20: Vulnerability confirmed 2023-07-01: Remediation released 2023-07-15: Vulnerability publicly disclosed Key References Obsidian Official Documentation Electron Security Guide MathJax Security Configuration Frequently Asked Questions Why was Obsidian Desktop targeted? - Obsidian Desktop is a widely used note-taking application with robust Markdown support. How can such vulnerabilities be prevented? - Regularly update software and avoid opening files from untrusted sources. Are there any known exploitation tools? - No public exploitation tools have been identified as of yet, but users are advised to remain vigilant. Additional Information Codeliant Security Research: Learn More Vulnerability Bounty Program: Participate in the Program --- Note: The above information is compiled based on the page content; for specific details, please refer to the original source.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-38746/7: Two RCEs in Obsidian Desktop via Markdown and MathJax Bypass with POC