Local Privilege Escalation in Notepad++ Installer

Executive Summary

This vulnerability exists in the Notepad++ installer versions from 8.9.4 to 8.9.6. During installation, the installer runs powershell.exe without specifying its absolute path after changing the working directory to the installation contextMenu directory.

If an attacker can place a malicious powershell.exe executable in a user-writable custom installation directory before installation, and a privileged user later runs the installer selecting that directory, the attacker's executable will be launched with elevated privileges.

This is a local privilege escalation vulnerability because it allows an attacker to gain higher privileges on the system by tricking the installer into running their malicious code.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Notepad++ installer invoking powershell.exe without an absolute path in a user-writable custom installation directory. Detection involves checking if a malicious powershell.exe has been pre-placed in such directories.

To detect this on your system, you can search for any powershell.exe files located in user-writable directories that could be used as custom installation directories for Notepad++. Specifically, look for powershell.exe files that are not in the standard system paths.

• Use the following command to find suspicious powershell.exe files in user-writable directories (example for Windows PowerShell):
• Get-ChildItem -Path C:\Users\*\* -Filter powershell.exe -Recurse -ErrorAction SilentlyContinue
• Check the directory permissions and ownership of any found powershell.exe files to verify if they are placed by an attacker.
• Additionally, monitor installer execution logs or use process monitoring tools to detect if powershell.exe is launched from unexpected directories during Notepad++ installation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited access to a system to escalate their privileges to those of the installer, which typically runs with elevated or administrative rights.

By exploiting this, an attacker could execute arbitrary code with higher privileges, potentially leading to full system compromise, unauthorized access to sensitive data, or the ability to install persistent malware.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Notepad++ installer allows local privilege escalation by executing a malicious powershell.exe with elevated privileges if placed in a user-writable directory. This could potentially lead to unauthorized access or control over a system.

Such unauthorized privilege escalation could impact compliance with standards like GDPR or HIPAA, which require strict controls over access to sensitive data and systems. If exploited, it may lead to data breaches or unauthorized data access, thereby violating these regulations.

However, the provided information does not explicitly discuss compliance impacts or specific regulatory consequences.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this local privilege escalation vulnerability in Notepad++ installer, ensure that you update Notepad++ to version 8.9.6 or later where the issue is fixed.

Additionally, avoid running the installer from user-writable custom installation directories where an attacker could place a malicious powershell.exe.

Useful 0 Not Useful 0