Greenshot is an open source Windows screenshot utility. Versions 1.3.312 and below have untrusted executable search path / binary hijacking vulnerability that allows a local attacker to execute arbitrary code when the affected Windows application launches explorer.exe without using an absolute path. The vulnerable behavior is triggered when the user double-clicks the application’s tray icon, which opens the directory containing the most recent screenshot captured by the application. By placing a malicious executable with the same name in a location searched prior to the legitimate Windows binary, an attacker can gain code execution in the context of the application. This issue did not have a patch at the time of publication.

Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.

Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.

Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WMCOPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic resides in a WinForms WndProc handler for WMCOPYDATA (message 74) that copies the supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, and only afterward checks whether the specified channel is authorized. Because the authorization check occurs after deserialization, any gadget chain embedded in the serialized payload executes regardless of channel membership. A local attacker who can send WMCOPYDATA to the Greenshot main window can achieve in-process code execution, which may aid evasion of application control policies by running payloads within the trusted, signed Greenshot.exe process. This issue is fixed in version 1.3.301. No known workarounds exist.

For some strange reason, despite it having had an unpatched 7.8 CVE for several years, we use Greenshot at our company. They recently released an update that patches that old CVE, which I guess is good, and computers in our environment started updating to this new version via Patch My PC this week.

However, one thing we have noticed is that it installs and activates the Imgur plugin by default.

This plugin adds an 'Upload to Imgur' option after taking a screenshot. The screenshot is immediately uploaded to Imgur, and a link to the image copied to the clipboard. By default, the upload is anonymous, so there is no way to delete uploaded images from Imgur. This is clearly an information security risk.

It looks like there is a way to apply a custom configuration to disable the Imgur plugin when you install Greenshot,, and I'm sure there are ways to skip the installation of the plugin through command-line parameters. But, if not (I haven't really done any client stuff in 3-4 years, so I'm kinda behind), you can modify the config file to disable it.

1. Go to C:\\Users%USERNAME%\\AppData\\Roaming\\Greenshot\\ 2. Edit 'Greenshot.ini' 3. Add 'Imgur Plugin' after 'ExcludePlugins=' 4. Add 'Imgur' after 'ExcludeDestinations='

Comma separated list of Plugins which are NOT allowed. ExcludePlugins=Imgur Plugin Comma separated list of destinations which should be disabled. ExcludeDestinations=Imgur

Though I'm sure the more security conscious people here will have already moved onto other tools already...