CVE-2020-14000: Remote Code Execution in scratch-vm
Summary
CVE-2020-14000: Remote Code Execution in scratch-vm. Affects scratch-vm versions < 0.2.0-prerelease.20200714185213. Fixed in 0.2.0-prerelease.20200714185213. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
scratch-vm is an npm package that is part of the MIT Lifelong Kindergarten Scratch project. It is responsible for loading extension URLs from project.json files. These extensions enhance the functionality of Scratch. However, a vulnerability in scratch-vm versions prior to 0.2.0-prerelease.20200714185213 allows for remote code execution. The issue arises when untrusted project.json files with certain characters are loaded, resulting in the execution of the URL's content as a script. This vulnerability is critical and has a CVSS score of 9.8.
Vulnerability Detail
The vulnerability in scratch-vm is due to the mishandling of extension URLs in project.json files. When certain characters, specifically '', are present in the URL, the content is treated as a script and executed as a worker. This allows an attacker to execute arbitrary code on the system where scratch-vm is running. The use of '' in the URL is incompatible with a protection mechanism in older versions, which split URLs to prevent deserialization attacks. It is important to note that the scratch.mit.edu hosted service is not affected by this vulnerability.
How To Fix
Minimum fixed version
0.2.0-prerelease.20200714185213
This is the first release that contains the fix.
npm install scratch-vm@0.2.0-prerelease.20200714185213Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of scratch-vm to mitigate the risk of remote code execution.
Conclusion
The vulnerability in scratch-vm allows for remote code execution, posing a significant risk to systems running vulnerable versions. To mitigate this risk, it is crucial to update to version 0.2.0-prerelease.20200714185213 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for scratch-vm →
FAQ
scratch-vm is an npm package that is part of the MIT Lifelong Kindergarten Scratch project. It is responsible for loading extension URLs from project.json files to enhance the functionality of Scratch.
This vulnerability allows an attacker to execute arbitrary code on systems running vulnerable versions of scratch-vm. This can lead to unauthorized access, data breaches, and other malicious activities.
No, the scratch.mit.edu hosted service is not affected by this vulnerability.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
No, there are no known workarounds for this vulnerability. It is essential to update to the fixed version of scratch-vm.
