Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context.
This issue is fixed in version 8.9.8.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/4cd74cb9347b9c6ca…
security-advisories@github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8
security-advisories@github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA…
security-advisories@github.com
https://notepad-plus-plus.org/news/v898-released
security-advisories@github.com