Notepad++ - Notepad# plugin local exploit

vendor:

Notepad++

by:

Sun Junwen

7,5

CVSS

HIGH

Stack Buffer Overflow

120

CWE

Product Name: Notepad++

Affected Version From: Notepad ++ 6.3.2 with Notepad# plugin (1.5) and Explorer plugin (1.8.2)

Affected Version To: Notepad ++ 6.3.2 with Notepad# plugin (1.5) and Explorer plugin (1.8.2)

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3 EN

2013

Notepad++ – Notepad# plugin local exploit

With Notepad# plugin (1.5) and Explorer plugin (1.8.2) installed in Notepad ++ 6.3.2, open the html file in attachement, click Enter in the last </script> tag, Npp will crash and calc.exe will open. Without Explorer plugin, these still can be exploit. Explorer plugin makes this easier. NotepadSharp plugin has several stack buffer overflow bug. In its PluginDefinition.cpp file, there are some char buffer whose length are 9999. They are all defined on stack. So if some strcpy/memcpy copy more than 9999 chars to these buffers, it leads to a stack overflow.

Mitigation:

Upgrade to the latest version of Notepad++ and Notepad# plugin.

Source

Exploit-DB raw data:

# Exploit Title: Notepad++ - Notepad# plugin local exploit
# Google Dork:
# Date: 2013-12-01
# Exploit Author: Sun Junwen
# Vendor Homepage: http://notepad-plus-plus.org/
# Software Link: http://notepad-plus-plus.org/download/
# Version: Notepad ++ 6.3.2 with Notepad# plugin (1.5) and Explorer plugin
(1.8.2)
# Tested on: Windows XP SP3 EN
# CVE :

1. Poc
With Notepad# plugin (1.5) and Explorer plugin (1.8.2) installed in Notepad
++ 6.3.2, open the html file in attachement, click Enter in the last
</script> tag, Npp will crash and calc.exe will open. Without Explorer
plugin, these still can be exploit. Explorer plugin makes this easier.

2. Root cause
NotepadSharp plugin has several stack buffer overflow bug.
In its PluginDefinition.cpp file, there are some char buffer whose length
are 9999. They are all defined on stack.
So if some strcpy/memcpy copy more than 9999 chars to these buffers, it
leads to a stack overflow.

3. Tested on
Windows XP SP3 EN
Notepad ++ 6.3.2
Notepad# plugin (1.5) and Explorer plugin (1.8.2)

Sun Junwen
Trendmicro, CDC



Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30007.zip