Executive Summary

This vulnerability exists in the Notepad++ installer versions from 8.9.4 to 8.9.6. During installation, the installer runs powershell.exe without specifying its absolute path after changing the working directory to the installation contextMenu directory.

If an attacker can place a malicious powershell.exe executable in a user-writable custom installation directory before installation, and a privileged user later runs the installer selecting that directory, the attacker's executable will be launched with elevated privileges.

This is a local privilege escalation vulnerability because it allows an attacker to gain higher privileges on the system by tricking the installer into running their malicious code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited access to a system to escalate their privileges to those of the installer, which typically runs with elevated or administrative rights.

By exploiting this, an attacker could execute arbitrary code with higher privileges, potentially leading to full system compromise, unauthorized access to sensitive data, or the ability to install persistent malware.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this local privilege escalation vulnerability in Notepad++ installer, ensure that you update Notepad++ to version 8.9.6 or later where the issue is fixed.

Additionally, avoid running the installer from user-writable custom installation directories where an attacker could place a malicious powershell.exe.

Useful 0 Not Useful 0