TOCTOU: HMAC Checks Disk, Executes from Memory

Notepad++ v8.9.6.2 — Attacker-Controlled UserCommand Execution via HMAC Race Condition

Advisory

Summary

Notepad++ v8.9.6.2 introduced an HMAC-SHA256 integrity check on shortcuts.xml to prevent injection of arbitrary UserCommand entries.

The check has a TOCTOU flaw: the HMAC is verified against the on-disk file at trigger time, but the command that executes is read from the in-memory _userCommands vector loaded at startup. These two sources are never re-synchronized.

An attacker who can write to shortcuts.xml can plant a malicious command before launch, let Notepad++ load it into memory, restore the legitimate file on disk, then trigger the command. The HMAC check passes (disk is clean), but the malicious payload executes (memory is stale).

Technical Overview

The integrity mechanism validates the current on-disk shortcuts.xml, while command execution uses a previously loaded in-memory representation. Because the two data sources are independent, an attacker can alter the file before startup, allow it to be parsed into memory, then restore the original file before command execution — causing the HMAC check to pass while the malicious payload runs.

Root Cause

NppCommands.cpp lines 4328–4359:

// TIME OF CHECK — reads on-disk file
std::string currentHMAC = computeHMAC(
    getMachineGUID(),
    getFileContent(nppParams.getShortcutsPath().c_str())
);
if (currentHMAC != nppGUI._shortcutsXmlHmacInConfig) { return; }
// validated against DISK

// TIME OF USE — reads in-memory vector (loaded at startup, never refreshed)
int i = id - ID_USER_CMD;
const vector<UserCommand>& cmds = nppParams.getUserCommandList();
UserCommand ucmd = cmds[i];
Command cmd(string2wstring(ucmd.getCmd(), CP_UTF8));
cmd.run(_pPublicInterface->getHSelf()); // executes payload from MEMORY

Attack Scenario

Pre-condition: write access to shortcuts.xml

• Portable install: same directory as notepad++.exe
• Standard install: %AppData%\Notepad++\

Steps:

1. Overwrite shortcuts.xml on disk with a malicious version (cmd = calc.exe)
2. Launch Notepad++ — _userCommands is populated from the malicious file
3. Restore the legitimate shortcuts.xml to disk — HMAC now matches config.xml
4. Send WM_COMMAND(21000) (ID_USER_CMD+0) or press Ctrl+Alt+P
5. HMAC check reads the legitimate file from disk → PASSES
6. Execution reads _userCommands[0] from memory → calc.exe runs

Result: execution of attacker-controlled commands under the privileges of the current user. No admin, no UAC, no user warning.

Execution Timeline

Impact

Proof of Concept

See poc_8962_toctou.ps1.

Requirements:

• Notepad++ v8.9.6.2 portable x64
• doLocalConf.xml present in the Notepad++ directory (portable mode)
• config.xml with a valid HMAC for the legitimate shortcuts.xml

.\poc_8962_toctou.ps1 -NppPath "C:\path\to\notepad++.exe"

Verified: calc.exe spawned (PID 35932), disk shows legitimate shortcuts.xml throughout.

Patch Analysis

The fix (commit 4f7563c) moves HMAC validation to startup, alongside the initial file parse. Check and Use now operate on the same object at the same time, eliminating the TOCTOU window.

References

• GHSA-qm4c-qg8p-qfcr
• Patch commit 4f7563c
• Notepad++ v8.9.6.4 release