Summary

An Unsafe Search Path vulnerability (CWE-426) exists when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application.

Details

The application constructs a command string that invokes explorer without specifying its absolute path:

if (doesPathExist(path.c_str()))
			{
				wchar_t cmdStr[1024] = {};
				if (getNodeType(selectedNode) == browserNodeType_file)
					wsprintf(cmdStr, L"explorer /select,\"%s\"", path.c_str());
				else
					wsprintf(cmdStr, L"explorer \"%s\"", path.c_str());
				Command cmd(cmdStr);

On Windows, when an executable is launched without a fully qualified path, the system resolves it using the standard search order, which may include the current working directory before trusted system locations. If a malicious explorer.exe is present in a directory searched earlier than System32, it could be executed instead of the legitimate Windows Explorer.

PoC

A video Proof of Concept is provided demonstrating the issue in the latest Notepad++ version (8.9.1). General reproduction steps:

1. A malicious executable named explorer.exe is placed in a directory that is resolved before the legitimate system binary.
2. The application is executed to open a path used as working directory.
3. When the application attempts to open a file or folder using Explorer, the malicious explorer.exe is executed.
4. The malicious binary follows the expected execution flow to avoid detection/app crash, but additionally launches calc.exe to demonstrate that arbitrary code execution is possible.

Impact

This vulnerability allows unsafe search path / binary hijacking.

As an example impact scenario, an adversary could introduce a malicious explorer.exe through poisoned installations or update mechanisms, ensuring the executable is placed in a directory that is searched before the legitimate Windows Explorer. When the application invokes Explorer, the attacker-controlled binary would be executed instead.

Successful exploitation may allow an attacker to execute arbitrary code with the privileges of the application, potentially leading to system compromise depending on the application's execution context.