GitHub Advisoryadvisory · npm

GHSA-vc9j-fhvv-8vrf Remote Code Execution in scratch-vm

CRITICAL Published 2020-07-27 Modified 2023-09-12 Official page ↗
Aliases
CVE-2020-14000
Ecosystem
npm
Packages
scratch-vm
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2020-07-27

Affected packages

• npm scratch-vm: < 0.2.0-prerelease.20200714185213 → fixed in 0.2.0-prerelease.20200714185213

Description

MIT Lifelong Kindergarten Scratch scratch-vm before `0.2.0-prerelease.20200714185213` loads extension URLs from untrusted project.json files with certain `_` characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is `getExtensionIdForOpcode` in serialization/sb3.js. The use of `_` is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.

Related

Alias · CVE (1)

  • CVE-2020-14000 MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References