Threat video1:00
Notepad++ GHSA-pg39-63h5-cx35: Exploitation Status & Fix
Notepad++ 8.9.9 and MIME Tools 3.2 fix six local flaws, including a WM_COPYDATA auth bypass. Get 9 detection rules, 6 IOCs and a free Splunk SPL rule.
Chapters
- 0:00The hookResearchers reproduced six local flaws in Notepad++.
- 0:05The storyNotepad++ 8.9.9 shipped fixes for six flaws.
- 0:12Attack pathResearchers reproduced a sender bypass.
- 0:30AttributionNo threat actor: this was defensive research.
- 0:34Indicators of compromise4 indicators to hunt: 1 registry key, 2 package names and 1 path.
- 0:40MITRE ATT&CK techniques7 ATT&CK techniques, from execution to impact.
- 0:44Remediation11 remediation steps are listed, 3 of them immediate.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Researchers reproduced six local flaws in Notepad++.
0:05Notepad++ 8.9.9 shipped fixes for six flaws.
0:10No CVEs assigned yet.
0:12Researchers reproduced a sender bypass.
0:15Then conditional escalation via NppExec.
0:19A TOCTOU race in the UAC save broker.
0:22Paste Binary over-read, SAML heap overflow.
0:26Upgrade to 8.9.9 and verify.
0:30No threat actor: this was defensive research.
0:344 indicators to hunt: 1 registry key, 2 package names and 1 path.
0:407 ATT&CK techniques, from execution to impact.
0:4511 remediation steps are listed, 3 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.