Executive brief
scratch-svg-renderer is a JavaScript library used to render SVG graphics in web applications, including the Scratch visual programming platform. The library fails to properly escape SVG input in its loadString function, allowing attackers to inject arbitrary HTML/JavaScript into the page via specially crafted SVG data. This could enable account takeover, credential theft, or malware distribution to all users viewing affected content.
Technical details
This is a stored/reflected cross-site scripting (XSS) vulnerability in scratch-svg-renderer's loadString function, which does not properly escape SVG data before injecting it into the DOM via the _transformMeasurements function (CWE-79). An attacker can craft malicious SVG input containing JavaScript payloads that execute in the context of the victim's browser with full page privileges. The attack requires no authentication but does require the victim to load a page containing the malicious SVG data (user interaction via visiting a crafted URL or loading untrusted SVG). An attacker can steal session cookies, perform actions on behalf of the user, or redirect to phishing sites. The vulnerability affects all versions before 0.2.0-prerelease.20201019174008 and was fixed by properly sanitizing SVG input.
Affected products
- LLK scratch-svg-renderer before 0.2.0-prerelease.20201019174008
Timeline
- 2020-11-09: disclosed
- 2020-10-19: patched