PT-2020-13829 · Mit Lifelong Kindergarten Scratch · Scratch-Vm

Apple502J · Published 2020-07-16 · Updated 2020-07-27 · CVE-2020-14000

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MIT Lifelong Kindergarten Scratch scratch-vm versions before 0.2.0-prerelease.20200714185213

Description The issue results in remote code execution because the URL's content is treated as a script and is executed as a worker when extension URLs are loaded from untrusted project.json files with certain characters. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. This is due to the incompatibility of the character with a protection mechanism in older versions, where URLs were split, preventing deserialization attacks. The scratch.mit.edu hosted service is not affected due to the lack of worker scripts.

Recommendations For versions before 0.2.0-prerelease.20200714185213, consider updating to a version that includes the fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting the use of characters in project.json files or disabling the execution of worker scripts until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-14000

GHSA-VC9J-FHVV-8VRF

Affected Products

Scratch-Vm

References · 7

• https://scratch.mit.edu/discuss/topic/422904/?page=1#post-4223443 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14000 · Security Note
• https://osv.dev/vulnerability/GHSA-vc9j-fhvv-8vrf · Vendor Advisory
• https://github.com/LLK/scratch-vm/pull/2476 · Note
• https://github.com/LLK/scratch-vm · Note
• https://github.com/LLK/scratch-vm/pull/2476/commits/90b9da45f4084958535338d1c4d71a22d6136aab · Note