Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

291–300 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#291

Post by amlib »

Baerbeisser wrote: post #265
TZubiri wrote: post #136

Earlier quoted context omitted.

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

There's still old tiny Metapad. And also more modern and fully featured (but still light) Notepad 2/3/4 and Notepad++. For full replacement, i just renamed all instances to notepad.exe.bak, back then on Windows 7 & 10, and rename-replaced it with metapad.exe. Though, i guess with UWP apps (modern Notepad is one), it's just file associations nowadays. There's surely some mass-reassociate utility around? Btw, nano is o…

If he learns vim... gasp ...he will be cursed with having to install vim in every machine he touches for the rest of his life! :)

Re: Windows Notepad App Remote Code Execution Vulnerability

#292

Post by bradfitz »

wlesieutre wrote: post #286
zerkten wrote: post #282

Earlier quoted context omitted.

Even if you talk to users, you can do it the wrong way. Big companies are incentivized by the stock market to care more about new users than existing ones because their only focus is growth. Growth can't be rooted in your existing users is a common feeling in product management circles. If you try to do things for people other than your existing users, then you end up doing odd stuff that at best is a mild annoyance.…

Exemplified by every website with a massive SIGN UP button and then a little 8 pt font log in tucked away somewhere underneath. Gee thanks for helping me find the button I'll use literally once and making me hunt for the one I'll need the other 99999 times I use this service. Existing users can go fuck themselves as long as new people are registering. Line go up!

I can’t tell you how relieving it is to hear somebody else complain about this. This has been my pet peeve for ages.

Re: Windows Notepad App Remote Code Execution Vulnerability

#293

Post by krater23 »

TZubiri wrote: post #146
rmunn wrote: post #7

"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files." I didn't even know Notepad would render Markdown.

I think it's very recent, I use it almost daily and only last week did I see a markdown file being rendered.

These kind of surprises are the reason why we should switch off auto update on every software.

Re: Windows Notepad App Remote Code Execution Vulnerability

#294

Post by eugenekolo »

gruez wrote: post #252
gcr wrote: post #246

Earlier quoted context omitted.

What does “unverified protocols” mean? Does Windows have an exe:// url scheme that fetches and runs executable binaries or something?

Yes? ShellExecute opens a url if you pass in a url, opens a file if you pass in a path, and runs an .exe if that file is an .exe. Windows also supports SMB paths, so combine that together and you have a RCE

But is it running ShellExecute on URIs?

Re: Windows Notepad App Remote Code Execution Vulnerability

#295

Post by spprashant »

latexr wrote: post #230
jfaganel99 wrote: post #11

Notepad had one job... Seems like bringing markdown features killed it :)

Something felt off about your comments, so I checked your account. You signed up almost six years ago, and in all that time made zero submissions and your only comments are these two on this thread? I’ve been seeing this more and more on HN. What exactly is going on here?

Looks like they logged in the first time in years to make a post https://news.ycombinator.com/item?id=46975123

And decided to jump in on some threads just as well.

Re: Windows Notepad App Remote Code Execution Vulnerability

#297

Post by ThrowawayB7 »

bigfatkitten wrote: post #160
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

If I had to guess, the mandate to cram AI in everywhere came down from Nadella and the executive level with each level of management having KPIs for AI in their product all the way down. Much like the "everything has to be .NET even though nobody has any idea what .NET means" when it was first introduced and every MS product suddenly sprouted .NET at the end of their names. When executive management gives stupid non-negotiable orders, they get stupid results.

Re: Windows Notepad App Remote Code Execution Vulnerability

#298

Post by bsza »

breppp wrote: post #277
usrbinbash wrote: post #184

Earlier quoted context omitted.

As funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a…

> Except no, we don't. notepad.exe was DONE SOFTWARE While 8.8 score is embarrassing, by no measure notepad was done software. It couldn't load a large text file for one, its search was barely functional, had funky issues with encoding, etc. Notepad++ is closer to what should be expected from an OS basic text editor

What counts as "large"? I'm pretty sure at some point in my life I'd opened the entirety of Moby Dick in Notepad. Unless you want to look for text in a binary file (which Notepad definitely isn't for) I doubt you'll run into that problem too often.

Also, I hope the irony of you citing Notepad++ [1] as what Notepad should aim to be isn't lost on you. My point being, these kinds of vulnerabilities shouldn't exist in a fucking text editor.

[1] https://notepad-plus-plus.org/news/hijacked-incident-info-up...

Re: Windows Notepad App Remote Code Execution Vulnerability

#299

Post by jerf »

Hackbraten wrote: post #191
BLKNSLVR wrote: post #182

Earlier quoted context omitted.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

The main problem with "Markdown support" in Notepad is that "Markdown support" is an ill-defined phrase. The closest thing to a well-defined definition is to support CommonMark but that is far, far from universal. Microsoft being Microsoft they'd probably still half-ass the job then just declare their new half-ass support a newly embraced-and-extended standard and leave it that way for the next 20 years, so asking Notepad to support Markdown is in practice asking for yet another effing Markdown dialect to come into existence and join the shambling hoard of other dialects.

Markdown is more properly understood as a family of related-but-mutually-incompatible standards, like CSV, and like "supporting CSV" is a lot more complicated than meets the eye. And supporting Markdown is already clearly non-trivial compared to the baseline of Notepad we've come to expect over the past few decades.

Re: Windows Notepad App Remote Code Execution Vulnerability

#300

Post by electroly »

eugenekolo wrote: post #294
gruez wrote: post #252

Earlier quoted context omitted.

Yes? ShellExecute opens a url if you pass in a url, opens a file if you pass in a path, and runs an .exe if that file is an .exe. Windows also supports SMB paths, so combine that together and you have a RCE

But is it running ShellExecute on URIs?

I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE.
Post reply on HN