Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things.

Apparently, the “innovation” of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system.

  • pkjqpg1h@lemmy.zipEnglish
    18·
    6 hours ago

    This has nothing to do with Markdown. It’s disinformation from Microslop.

    You can make the link C:\windows\system32\cmd.exe hn

    This is so stupid. Why did they add something like this? In Markdown, there is no execution. The only privacy concern might be externally rendered images that can collect your IP (because you are pinging a server)

  • Bytemeister@lemmy.worldEnglish
    46·
    11 hours ago

    Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 2 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 150mil in options and bonuses.

    • MinnesotaGoddam@lemmy.worldEnglish
      38·
      10 hours ago

      Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.9 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 149mil in options and bonuses.

  • MuskyMelon@lemmy.worldEnglish
    12·
    9 hours ago

    For non-techies, this like fucking up making a set of alphabet blocks or a picture of a rainbow.

  • M0oP0o@mander.xyzEnglish
    23·
    11 hours ago

    HA, how do you fuck up notepad?! Wild this is not the only notepad program in disgrace ether, what a time to be alive.

    Hows the whole “must update for security” people doing?

    • ChickenLadyLovesLife@lemmy.worldEnglish
      12·
      5 hours ago

      Back in the year 2000 I was writing intranet apps for a big corporation, using Visual Basic and classic ASP (lol) and IE6 (lolol) for the UI. A very handy if not indispensable tool for this sort of work is the ability to View Source on the generated pages, which popped up the HTML in Notepad. One day for me this simply stopped worked entirely – hitting View Source did nothing and I couldn’t fix the problem on my computer no matter what I did (other people’s computers still worked fine). I even switched to a different computer, set up all my tools and programs as normal, and got the same problem with View Source not working at all. I went like this for six months, and it was a real challenge to debug problems.

      Eventually I discovered the problem from a forum post: I had a shortcut to Notepad on my desktop. For no reason I can possibly imagine, this prevented View Source from doing anything at all. It didn’t even have to be a shortcut to Notepad proper; any shortcut that happened to be named “Notepad” would cause the break even if it was a shortcut to some other program. Renaming my shortcut to “NotepadX” fixed the problem. I would LOVE to have some old MS engineer explain to me what the living fuck was going on here.

      • Liketearsinrain@lemmy.mlEnglish
        2·
        2 hours ago

        I have a pretty good guess. They were using ShellExecute or a similar API with only "notepad” as a name or “edit” as a verb. The search order would end up finding your shortcut first.

        This would be odd behavior (the path should be be the full path and start at system32) but I don’t have IE6 and Windows 95 to find the exact API lol.

        • ChickenLadyLovesLife@lemmy.worldEnglish
          1·
          1 hour ago

          The search order would end up finding your shortcut first.

          Sure, but in my case “Notepad” was a shortcut to actual Notepad.exe. It still should have worked.

          • bitjunkie@lemmy.worldEnglish
            1·
            31 minutes ago

            iirc .lnk files didn’t pass along params to the actual executable, at least not in 9x

            src: first tech job was at a MS silver partner in the 90s

      • limelight79@lemmy.worldEnglish
        3·
        5 hours ago

        That has to be some kind of special exception in IE6 that they were doing for debugging, and they failed to remove it. Crazy.

    • Log in | Sign up@lemmy.worldEnglish
      13·
      9 hours ago

      If you’re still on windows 10, notepad is fine, but you might not be getting security updates for the whole OS. If you’re on windows 11, notepad is annoying, bloated, has AI, and is a security risk. Also the OS updates you are getting might well be written by AI, and we all know how infallible AI is, right?

  • dbtng@eviltoast.orgEnglish
    182·
    18 hours ago

    I miss oldskool Notepad being present on the system. Win11 Notepad is a worthless piece of shit.
    But … any computer or vm that I use for more than a few hours gets a copy of Metapad.

    I’ve been using Metapad for … umm … decades.
    Metapad is a simple, extremely lightweight editor, intended to just barely be better than Notepad, fixes a lot of shit that MS never did and stays simple.
    https://liquidninja.com/metapad/

    • Lfrith@lemmy.caEnglish
      1·
      9 hours ago

      Windows 11 ltsc comes with old Notepad. Looks like the same one from Windows 10.

    • Professor_Piddles@sh.itjust.worksEnglish
      121·
      17 hours ago

      I’ve been a long time user of Notepad++ after Notepad started inserting random whitespace characters in files, which messed up some jankety scripting I was doing at the time. Do you happen to know if Metapad is good about not adding unintended characters like that?

      • Log in | Sign up@lemmy.worldEnglish
        2·
        9 hours ago

        I use EditPadLite and have done for a loong time. It has regex find and replace, is fast and you can tell it to display word wrapped or not, numbered lines or not, font, size, colours, syntax highlighting scheme, all based on file extensions. I have it as my default text editor and for all kinds of other files as well as text.

        If I want to do major coding, I fire up the IDE and choose from my recent projects, but if I want to quickly edit some xml or a single source file, I double click it and edit it in EditPadLite.

      • dbtng@eviltoast.orgEnglish
        8·
        15 hours ago

        Yes. Metapad is too dumb for that shit. By design.
        It’s only barely smart enough to be better than Notepad.
        It’s not smart enough to do anything dumb.

        Its free, extremely mature, and you already know how to use it.
        Metapad is a feature-for-feature drop-in replacement for Notepad.

  • FaceDeer@fedia.io
    462·
    1 day ago

    An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad

    So you can give someone a Markdown file with a link to an application, and if they click the link the application runs.

    Markdown supports links, yeah.

    • Echo Dot@feddit.ukEnglish
      593·
      1 day ago

      But Notepad doesn’t, so it shouldn’t render .md files, it should just show the markdown code.

      They keep adding stuff to notepad that no one was asking for. Like tabs and saving on exit, which breaks the workflow of having notepad be a throwaway scratch pad.

        • andz@lemmy.worldEnglish
          2·
          5 hours ago

          Have been for a while now. In neat (read: horrible) little tabs that never go away unless you manually force them to.

      • Taleya@aussie.zoneEnglish
        9·
        18 hours ago

        Fucking hell i have notepad++ for that shit.

        Average users don’t need that functionality , and those that do already don’t use notepad for it

        • Echo Dot@feddit.ukEnglish
          1·
          3 hours ago

          My god it’s useless. It’s the most limited markdown editor in the world. It lacks so much basic function that you would have to download an actual markdown editor if you were ever going to use it, so there’s no point in notepad having the functionality, and then at the end of the day it’s in a file format that basically doesn’t exist outside of the web.

          Microsoft Word cannot open it. So a Microsoft text editor program, can create a file that a different Microsoft text editor program can’t read, despite markdown being a supposedly universal standard. Wow.

      • PoopingCough@lemmy.worldEnglish
        111·
        24 hours ago

        Funnily enough, you used as an example the only new feature I actually like and rely on. I use it for things like PWs for shared service accounts (dont @ me, I know it’s bad practice and our org does have a pw manager but these accounts aren’t managed by it and I am not in control of them)

        Also useful for things that are needed temporarily but I dont know how long that ‘temporary’ is going to be.

        • jj4211@lemmy.worldEnglish
          1·
          2 hours ago

          keeppassxc for local password manager. More secure and more helpful UI for that very purpose, also can hold your top and let you ctrl-t the current number into to clipboard.

  • Armand1@lemmy.worldEnglish
    1141·
    1 day ago

    To be fair, markdown is a very cool standard.

    While I don’t know if it really makes sense for Notepad to be anything other than a plain-text editor, there are better tools for that, supporting markdown is kind of nice.

    This means you have support for it on fresh Windows installs, which could be good for virtual machines. That said, Markdown is intrinsically pretty readable without formatting anyway.

    It’s a shame they flubbed the implementation though…

    • [deleted]@piefed.worldEnglish
      118·
      1 day ago

      Windows used to come with notepad (raw text) and wordpad (basic markup). It would have made more sense to keep wordpad and add markdown to it instead so there would still be something that is just raw text.

      • ggtdbz@lemmy.dbzer0.comEnglish
        67·
        1 day ago

        I thought the Notepad > Wordpad > MS Word progression was pretty much perfect. A zero complication plaintext editor, something with a bit more formatting, and outright typesetting for print.

        Granted I use a combination of Notepad++, Obsidian, and haphazard LaTeX venvs now so who am I to talk. I don’t represent most Windows users and especially not the Linux daily drivers. I’d like to think there’s still a lot of people in my situation.

        It says a lot that none of the reasons I like Notepad++ were brought into Notepad when they changed it. A copilot button in the place where I write immediate notes and edit batch files? What could possibly be the use case? I just need it to be able to open massive text files and have a decent search UI and that’s it

        • Log in | Sign up@lemmy.worldEnglish
          2·
          9 hours ago

          WordPad writes fairly clean rtf. Word writes incredibly bloated messy rtf. No, I don’t want to use a .docx or .pdf generating library, I just wanna slap some strings together and have it come out ready to print yet editable by non techy users. I use wordpad to write my templates.

        • borari@lemmy.dbzer0.comEnglish
          6·
          1 day ago

          I’m a huge proponent of LaTeX also, but I feel like it’s not that widely used outside of specific professional niches. The biggest issue I have with Word (and similar software) is the content generation and typesetting being forced into the same interface. It just breaks everything all the time. I’d much happier using word if it only allowed you to type in an Edit mode, and only allowed you to change fonts and layout and stuff in a View mode, and the View mode changes weren’t reflected live in the Edit mode.

          • ggtdbz@lemmy.dbzer0.comEnglish
            4·
            23 hours ago

            I’ve had to use Office a lot professionally and I have to say you do get to learn its quirks over time if you’re stubborn enough to figure out what triggers each unexpected behavior. Ironically learning LaTeX really helped me figure out what’s happening internally in Word in some of those situations, just understanding how the breaks and spaces might be stored gives you a little extra insight.

            AFAIK you can do something similar to what you’re describing in outline mode but I could be completely misremembering.

            All the Office suite is bloated but LibreOffice still feels a long way off.

      • Armand1@lemmy.worldEnglish
        122·
        1 day ago

        The point is that I’ve seen several comments on other posts about this vulnerability, and in the body of this one, saying that Notepad is bloated and terrible now.

        I’m offering a counterpoint that this is not necessarily bloat. It’s debatable that this is the right tool to have this feature, but it can be a useful feature.

        I’m fine with Markdown support, but I wish MS got the message about Copilot being unwanted. Not sure if they’ve added it to Notepad or not at this stage, but given all the places they’ve crammed it into I wouldn’t be surprised.

        • forrgott@lemmy.sdf.orgEnglish
          97·
          1 day ago

          …a counterpoint that this is not necessarily bloat. It’s debatable that this is the right tool to have this feature…

          That’s called bloat.