Command Injection in Notepad++ via Malicious Shortcuts

Executive Summary

This vulnerability exists in Notepad++ versions prior to 8.9.6.1. It involves the way the application processes the <Command> tag inside <UserDefinedCommands> in the shortcuts.xml file. The text content of this tag is read and stored without any validation. When a user clicks the corresponding entry in the Run menu, the application executes the attacker-controlled command string as an executable path via ShellExecute. This means an attacker can inject malicious commands that appear as normal menu items, providing a persistence mechanism within the application.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious commands injected into the <Command> tag inside <UserDefinedCommands> in the shortcuts.xml file of Notepad++ prior to version 8.9.6.1. Detection involves inspecting the shortcuts.xml file for unexpected or suspicious entries under <UserDefinedCommands>.

Since the injected commands appear as normal menu items in the Run menu, reviewing the shortcuts.xml file manually or via scripts can help identify unauthorized commands.

A suggested approach is to search for the shortcuts.xml file in the Notepad++ configuration directory and examine the <UserDefinedCommands> section for suspicious commands.

• On Windows, locate the shortcuts.xml file typically found in %APPDATA%\Notepad++\shortcuts.xml.
• Use a command like: findstr /I /C:"<UserDefinedCommands>" %APPDATA%\Notepad++\shortcuts.xml to locate the section.
• Use a text editor or command-line tools (e.g., PowerShell) to search for suspicious or unexpected commands within the <Command> tags.

Network detection is less applicable since the vulnerability is local and triggered by user interaction with the Run menu in Notepad++. Monitoring for unexpected process executions of commands originating from Notepad++ could be a complementary detection method.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to high impact consequences including unauthorized code execution with high confidentiality, integrity, and availability impact. An attacker can inject and execute arbitrary commands when a user selects the malicious menu item, potentially leading to system compromise, data loss, or other malicious activities. Since the injected command appears as a normal menu item, it can persist and be triggered repeatedly.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Notepad++ version 8.9.6.1. Immediate mitigation involves updating Notepad++ to version 8.9.6.1 or later.

Useful 0 Not Useful 0