Improper access control in Notepad++ - #VU133095

Detailed vulnerability description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper access control in command execution from shortcuts.xml when invoking trusted executables from allowed directories. A local user can specify a trusted launcher such as cmd.exe, powershell.exe, or rundll32.exe with attacker-controlled arguments to execute arbitrary code.

The issue occurs without a warning dialog because the executable itself resides in a trusted directory even though its arguments can launch arbitrary commands.

Remediation

Sources

• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6
• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/ea1508855e9c4528f6198ce9d345f13cb759ebf4