Notepad++ < 8.8.9 Update Integrity Verification Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297910);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-15556");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/03/05");
  script_xref(name:"IAVA", value:"2026-A-0096-S");

  script_name(english:"Notepad++ < 8.8.9 Update Integrity Verification Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The text editor on the remote Windows host is affected by an update integrity vulnerability.");
  script_set_attribute(attribute:"description", value:
"Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain a vulnerability where downloaded update 
metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update 
traffic can cause the updater to download and execute an attacker-controlled installer, resulting in 
arbitrary code execution with the privileges of the user.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version 
number.");
  # https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c45e063");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Notepad++ 8.8.9 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-15556");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:notepad-plus-plus:notepad\+\+");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("notepad_plus_plus_win_installed.nbin");
  script_require_keys("installed_sw/Notepad++", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Notepad++', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '8.8.9'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);