CVE-2020-14000
📋 TL;DR
This vulnerability in Scratch VM allows remote code execution by loading malicious extension URLs from untrusted project files. Attackers can execute arbitrary code by crafting project.json files with specific _ characters. Only self-hosted Scratch instances are affected - the official scratch.mit.edu service is not vulnerable.
💻 Affected Systems
- scratch-vm
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the Scratch VM host, potentially leading to data theft, further network penetration, or ransomware deployment.
Likely Case
Malicious project files execute arbitrary JavaScript code in the Scratch VM context, potentially stealing user data, modifying projects, or using the system for cryptocurrency mining.
If Mitigated
If proper input validation and URL sanitization are implemented, the vulnerability is prevented and no code execution occurs.
🎯 Exploit Status
Exploitation requires users to load malicious project files, which could be distributed through Scratch project sharing platforms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.0-prerelease.20200714185213 and later
Vendor Advisory: https://github.com/LLK/scratch-vm/pull/2476
Restart Required: Yes
Instructions:
1. Update scratch-vm to version 0.2.0-prerelease.20200714185213 or later. 2. Restart the Scratch VM service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable extension loading
allPrevent loading of external extensions from project files
Modify serialization/sb3.js to disable getExtensionIdForOpcode functionality
Input validation filter
allAdd filtering for _ characters in extension URLs
Implement URL sanitization before processing in getExtensionIdForOpcode
🧯 If You Can't Patch
- Isolate Scratch VM instances from sensitive systems and networks
- Implement strict project file validation and scanning before allowing uploads
🔍 How to Verify
Check if Vulnerable:
Check if scratch-vm version is earlier than 0.2.0-prerelease.20200714185213Check Version:
npm list scratch-vm or check package.json versionVerify Fix Applied:
Verify version is 0.2.0-prerelease.20200714185213 or later and test with known malicious project files📡 Detection & Monitoring
Log Indicators:
- Unusual extension URL loading patterns
- Multiple failed extension loads with _ characters
- Unexpected worker script execution
Network Indicators:
- Outbound connections to unusual domains from Scratch VM
- Downloads of external scripts during project loading
SIEM Query:
source="scratch-vm" AND (extension_load_failure OR worker_script_execution)