Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

311–320 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#311

Post by iso1631 »

theandrewbailey wrote: post #179
EE84M3i wrote: post #140

Earlier quoted context omitted.

I explicitly stopped this habit so that I don't accidentally do it with sensitive data I don't want to go to my search engine provider's auto complete API.

Disabling remote search autocomplete is one of the first things I do when I setup a new browser instance. It's a privacy and security nightmare I don't want.

ctrl-k is for the search box

ctrl-l is for the address box

At most I want the address box to do is look up a dns name. Which can still be a risk if I were to hit "enter" with sensitive information which could in some cases get pushed out to my DNS provider (which is me, but then it's possible the address would be pushed out to another resolver, and will also be logged in an unexpected place)

Re: Windows Notepad App Remote Code Execution Vulnerability

#312

Post by laserbeam »

graemep wrote: post #260
mjmas wrote: post #134

It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

Is this a big deal? is it also not a problem with anything that renders clickable links? Browsers, email clients, whatever. Is this not a problem with anything that offers a preview of markdown (or HTML, or anything with embedded links)?

The problem is notepad itself would download and execute bad stuff if you click the evil link. If you would paste that same link in a browser you'd be ok.

And the problem is a notepad app is expected to be dead simple, have few features, and be hard to get wrong while implementing.

Re: Windows Notepad App Remote Code Execution Vulnerability

#313

Post by titzer »

Someone1234 wrote: post #236
Hackbraten wrote: post #191

Earlier quoted context omitted.

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

You cannot claim you're "against feature bloat" while then in the same breath say that it is acceptable that a basic text editor have an entire additional render pipeline. If you want Markdown use VSCode, it is a first class citizen. Don't take an intentionally stripped down text editor and bolt on VSCode-like features.

As I posted in a sibling, I thought the whole point of markdown was that it was simplified to the point that rendering it was easy to do from scratch. But we fumbled that because we (collectively) have no idea what we are doing.

Re: Windows Notepad App Remote Code Execution Vulnerability

#314

Post by b3lvedere »

gchamonlive wrote: post #235
b3lvedere wrote: post #217

Earlier quoted context omitted.

Affermative. You have unlocked the following achievement: "Get a head start of 45 minutes when we start destroying humanity".

Since there'll be nowhere to run, could I be one the first? Don't wanna have to deal with the hassle of having to watch my loved ones being chased down.

Agreed. Your achievement has been revoked effective immediately.

Re: Windows Notepad App Remote Code Execution Vulnerability

#315

Post by gruez »

electroly wrote: post #300
eugenekolo wrote: post #294

Earlier quoted context omitted.

But is it running ShellExecute on URIs?

I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into di…

>Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE.

1. You can use UNC paths to access remote servers via SMB

2. Even if it's local, it's still more useful than you make it out to be. For instance, suppose you downloaded a .zip file of some github project. The .zip file contains virus.exe buried in some subfolder, and there's a README.md at the root. You open the README.md and see a link (eg. "this project requires [some-other-project](subfolder\virus.exe)". You click on that and virus.exe gets executed.

Re: Windows Notepad App Remote Code Execution Vulnerability

#317

Post by iso1631 »

BLKNSLVR wrote: post #182
mjmas wrote: post #134

It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

> Oil, water temperature and alternator warning lights would be replaced by a single 'general car default' warning light.

> Occasionally, for no reason, your car would lock you out and refuse to let you in until you simultaneously lifted the door handle, turned the key, and grabbed the radio antenna.

> Every time GM introduced a new model, car buyers would have to learn how to drive all over again because none of the controls would operate in the same manner as the old car.

> You would press the 'start' button to shut off the engine.

If you live long enough, satire eventually becomes reality.

Re: Windows Notepad App Remote Code Execution Vulnerability

#318

Post by titzer »

mdavid626 wrote: post #31
voidUpdate wrote: post #26

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

I feel bad for anyone at MS who thought these applications needed anything more than bugfixes. Welcome to the Notepad team, the entire world would be better off it you did nothing at all!

Re: Windows Notepad App Remote Code Execution Vulnerability

#319

Post by 0xmattf »

hdgvhicv wrote: post #47

So notepad now renders links, then when clicks execute the code on those links (not just loading a website in a browser for example)?

I'm at work, on a work computer, so can't fully test, but yes.

I saved this as test.md, opened it in notepad, clicked the link, and it popped open a command line:

[Click me](C:/Windows/System32/cmd.exe)

Can definitely go further than this; just a quick test.

To be fair, though, it's not just a click -> open/run. The user has to `ctrl+click` and will see the source of the link (at least I do).

Re: Windows Notepad App Remote Code Execution Vulnerability

#320

Post by appreciatorBus »

onion2k wrote: post #245
wormpilled wrote: post #240

Earlier quoted context omitted.

Why can't Indian software developers stand up for themselves and say no?

Because there are plenty of developers who'll say yes, so anyone saying no is putting their ethics ahead of their livelihood. Few people will be willing to put their beliefs ahead of providing for their family. It's easy to say you will, and very hard to actually do it.

You can say exactly the same thing about the management and the shareholders. If they say no, someone else will say yes, so why blame them?
Post reply on HN