Notepad++ Flaw Allows Attackers to Hijack Update Traffic and Deploy Malware

A critical security flaw in the popular text editor Notepad++ has been addressed with the release of version 8.8.9, which patches a vulnerability that could have allowed traffic hijacking.

The vulnerability, which affects the software’s update mechanism, could have potentially enabled attackers to intercept network traffic and install malicious software on users’ systems.

Notepad++ Flaw

Recently, security experts reported incidents where the Notepad++ updater, known as WinGUp, was compromised, redirecting traffic to malicious servers. Investigations revealed a weakness in the updater’s file validation process.

In a typical attack scenario, threat actors could intercept network traffic between the updater client and the Notepad++ infrastructure, leveraging the validation weakness to force the updater to download and execute a compromised binary instead of the legitimate update file.

This type of “Man-in-the-Middle” (MitM) attack effectively bypasses the user’s trust in the software’s automated update process.

To combat this threat, the Notepad++ team has introduced significant security enhancements in version 8.8.9, hardening the updater to strictly verify the digital signature and certificate of any installer before execution.

If the verification step fails, the update process is immediately aborted to protect the user. Additionally, the developers noted that, starting with version 8.8.7, all Notepad++ binaries are digitally signed with a legitimate GlobalSign certificate.

As a result, users no longer need to install the Notepad++ root certificate manually. The team recommends that users who previously installed this root certificate should now remove it to maintain a clean security posture.

While the immediate vulnerability has been patched, the investigation into the exact methods used to hijack the initial traffic is ongoing. The Notepad team has promised to share further details with the community once tangible evidence regarding the root cause is established.

Users are urged to update to version 8.8.9 immediately to ensure their software verifies the integrity of future updates. This release also includes various bug fixes and additional enhancements unrelated to the security patch.