# Command injection by setting a custom search engine

Notepad++ passes the user-configurable custom search engine string to ShellExecute unvalidated, so a malicious config.xml yields arbitrary command execution on 'Search on Internet'.

- Payout: hidden
- Severity: medium
- Program: Notepad++
- Found by: peter_
- Disclosed: 2019-05-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/497312
- Library page: https://bugbountylibrary.com/r/h1%3A497312
- Tags: area:os domain:desktop impact:integrity impact:rce kind:bounty platform:hackerone sev:medium tech:windows technique:source-review vuln:command-injection vuln:rce

**Target:** Windows desktop text editor 'Search on Internet' context menu / config.xml
**Root cause:** IDM_EDIT_SEARCHONINTERNET assumes the custom search engine is a well-formed HTTP URL and passes it to Command::run, which calls ShellExecute without validating the http:// or https:// prefix.
**Steps:**
1. Set searchEngineCustom to `cmd.exe /c calc.exe` and searchEngineChoice=0 in config.xml GuiConfig, or via Settings > Preferences > Search Engine
2. Copy config.xml to `%APPDATA%\Notepad++`
3. Run Notepad++ and right-click in the text field
4. Select 'Search on Internet' — ShellExecute runs the command, opening calc.exe
**How found:** Code review of NppCommands.cpp IDM_EDIT_SEARCHONINTERNET handler traced the custom search engine string into Command::run and ShellExecute, noting no check that the URL starts with http:// or https://.
**Exploitation:** Attacker supplies a crafted config.xml (e.g. presented as an example config) or a program with user permissions writes to %APPDATA%; on each 'Search on Internet' invocation ShellExecute executes the injected command instead of opening a browser.
**Insight:** When a desktop app shells out to open a 'URL', check whether the string is validated as a scheme before ShellExecute — config-file-controlled settings that feed ShellExecute are a reliable command-injection path.