CVE-2020-14000 Remote Code Execution in scratch-vm
Attackers can achieve remote code execution by crafting malicious project files that exploit unsafe URL loading in the Scratch VM library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14000?
CVE-2020-14000 is a critical unsafe deserialization vulnerability in n/a, published on 16 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.
Weakness: CWE-502
Which versions are affected by CVE-2020-14000?
2 open source packages ship an affected version, including scratch-vm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
scratch-vm npm | All versions | 0.2.0-prerelease.20200714185213 |
scratch-vm npm | All versions | 0.2.0-prerelease.20200714185213 |
Products include Mit Scratch-Vm.
How do I fix CVE-2020-14000?
Upgrade scratch-vm to 0.2.0-prerelease.20200714185213 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-14000 being exploited?
There is no known exploitation of CVE-2020-14000 in the wild and no public exploit code.
Sources
Also known as GHSA-vc9j-fhvv-8vrf.