Executive brief
Scratch is a visual programming platform widely used in educational settings to teach coding. The scratch-vm component loads extension scripts from URLs embedded in project files. An attacker can craft a malicious project file that loads and executes arbitrary code as a worker script, compromising systems running vulnerable versions of Scratch. This affects any Scratch installation using the vulnerable library that opens untrusted project files.
Technical details
The vulnerability is an unsafe deserialization issue (CWE-502) in the getExtensionIdForOpcode function within serialization/sb3.js. The code fails to properly validate extension IDs extracted from project.json files, allowing underscore characters that bypass URL-splitting protection mechanisms. When a malicious project file contains crafted extension IDs with underscores, the code treats extension URLs as scripts and executes them as workers without proper sandboxing. The attack requires no authentication or user interaction beyond opening a malicious .sb3 project file. The scratch.mit.edu hosted service is not affected due to architectural differences in how it handles worker scripts. A patch was released in version 0.2.0-prerelease.20200714185213 that sanitizes extension IDs to allow only alphanumerics and hyphens.
Affected products
- MIT Lifelong Kindergarten scratch-vm before 0.2.0-prerelease.20200714185213
Timeline
- 2020-07-27: disclosed
- 2020-07-14: patched: Fix released in version 0.2.0-prerelease.20200714185213