Executive Summary

This vulnerability exists in Notepad++ versions prior to 8.9.6.4. It involves a time-of-check to time-of-use (TOCTOU) flaw in how the application verifies user commands stored in the shortcuts.xml file. At startup, Notepad++ loads user commands from shortcuts.xml into memory. When a command is executed, the application checks the HMAC of the on-disk shortcuts.xml file to ensure integrity. However, the in-memory commands are not re-synchronized with the file after startup.

An attacker with write access to shortcuts.xml can exploit this by placing a malicious shortcuts.xml file on disk before the application starts, then immediately restoring the legitimate file. The HMAC check at command execution validates the restored legitimate file, but the malicious commands loaded in memory at startup are executed, bypassing the integrity check.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with write access to the shortcuts.xml file to execute malicious commands within Notepad++ without detection by the application's integrity checks. This could lead to unauthorized code execution or other malicious actions performed under the context of the user running Notepad++. The attacker can bypass security mechanisms that rely on verifying the integrity of the shortcuts.xml file.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Notepad++ to version 8.9.6.4 or later, where the issue has been fixed.

Additionally, restrict write access to the shortcuts.xml file to prevent attackers from placing malicious versions before application startup.

Useful 0 Not Useful 0