CVE-2023-6401: Notepad++ Path Traversal Vulnerability

CVE-2023-6401 Overview

A vulnerability classified as problematic was found in Notepad++ up to version 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to an uncontrolled search path vulnerability (CWE-427), which could allow an attacker with local access to achieve privilege escalation or execute arbitrary code by placing a malicious DLL in the application's search path.

Critical Impact

Local attackers could exploit the uncontrolled search path vulnerability to execute malicious code with the privileges of the Notepad++ process, potentially leading to full system compromise.

Affected Products

• Notepad++ versions up to 8.1
• Systems running affected versions of Notepad++ with dbghelp.exe
• Windows environments where Notepad++ is installed

Discovery Timeline

• 2023-11-30 - CVE-2023-6401 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-6401

Vulnerability Analysis

This vulnerability is an uncontrolled search path issue (CWE-427) affecting Notepad++ versions through 8.1. The flaw exists within the application's handling of the dbghelp.exe component, where improper control over the search path allows for potential DLL hijacking attacks. When the application attempts to load a required library, it may search in directories that an attacker can influence before checking trusted locations.

The local attack vector requires an attacker to have some level of access to the target system. Once positioned, they can place a malicious DLL in a directory that is searched before the legitimate Windows system directory. When Notepad++ or its associated dbghelp.exe component loads, it may inadvertently load the attacker's malicious library instead of the legitimate one.

Root Cause

The root cause of CVE-2023-6401 is the application's failure to properly specify or control the search path when loading external libraries or executables. When Windows searches for DLLs to load, it follows a specific search order that typically includes the application's directory, the current working directory, and various system directories. If the application does not explicitly specify the full path to required libraries or does not restrict the search order, an attacker can exploit this by placing a malicious DLL in a higher-priority search location.

Attack Vector

The attack requires local access to the target system. An attacker would need to:

1. Identify a writable directory that appears in the DLL search path before trusted system directories
2. Place a malicious DLL with the same name as a legitimate library expected by Notepad++ or dbghelp.exe
3. Wait for or trigger the execution of Notepad++
4. When the application loads, it searches for required libraries and finds the malicious DLL first
5. The malicious code executes with the same privileges as the Notepad++ process

The vulnerability can be exploited without user interaction once the malicious DLL is in place. The attack relies on the predictable behavior of the Windows DLL search order and the application's failure to use secure loading practices.

Detection Methods for CVE-2023-6401

Indicators of Compromise

• Unexpected DLL files appearing in Notepad++ installation directories or user-writable paths
• Suspicious dbghelp.dll or similarly named files in non-standard locations
• Process execution anomalies where Notepad++ spawns unexpected child processes

Detection Strategies

• Monitor for DLL loading events from Notepad++ that originate from unexpected directories
• Implement file integrity monitoring on Notepad++ installation directories
• Use application whitelisting to detect unauthorized library loads

Monitoring Recommendations

• Enable Windows Security Event logging for process creation and DLL loading events
• Configure SIEM rules to alert on Notepad++ loading libraries from user-writable directories
• Regularly audit the Notepad++ installation directory for unauthorized modifications

How to Mitigate CVE-2023-6401

Immediate Actions Required

• Upgrade Notepad++ to the latest available version
• Restrict write permissions to the Notepad++ installation directory
• Implement application whitelisting to prevent unauthorized DLL loading
• Audit systems for any suspicious DLLs in the application's search path

Patch Information

The vendor was contacted about this vulnerability but did not respond. Users should upgrade to the latest version of Notepad++ if available, as newer versions may address this issue. For additional technical details and tracking information, refer to VulDB #246421.

Workarounds

• Ensure the Notepad++ installation directory and its parent directories are only writable by administrators
• Remove write permissions for standard users from directories in the application's search path
• Consider running Notepad++ in a sandboxed environment to limit potential impact
• Use Windows Defender Application Control (WDAC) or AppLocker policies to restrict DLL loading

# Configuration example - Restrict directory permissions
# Set ACL to prevent non-admin users from writing to Notepad++ directory
icacls "C:\Program Files\Notepad++" /inheritance:r /grant:r Administrators:F /grant:r "SYSTEM":F /grant:r Users:RX