CVE-2021-29437
📋 TL;DR
This vulnerability allows third-party websites to trick Scratch users into revealing OAuth2 login codes, enabling attackers to impersonate users and gain full access to their Scratch accounts. It affects users of ScratchOAuth2 implementations who interact with malicious websites. The flaw is in the OAuth2 implementation's authentication flow.
💻 Affected Systems
- ScratchOAuth2
📦 What is this software?
Scratchoauth2 by Scratchoauth2 Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full control of user's Scratch account, allowing them to modify projects, post malicious content, steal personal data, and perform actions as the victim.
Likely Case
Account takeover leading to unauthorized modifications of user projects, posting of malicious content, and potential data theft.
If Mitigated
Limited impact if users are educated about phishing risks and avoid posting codes from untrusted sources.
🎯 Exploit Status
Exploitation requires social engineering to trick users into posting codes, but the technical complexity is low.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 9220c2a77eda3df37a84486ad722f1ad0985d8e7
Vendor Advisory: https://github.com/ScratchVerifier/ScratchOAuth2/security/advisories/GHSA-gvpg-23fh-8g75
Restart Required: No
Instructions:
1. Update to the patched version of ScratchOAuth2. 2. Apply commit 9220c2a77eda3df37a84486ad722f1ad0985d8e7. 3. Verify the fix by testing the OAuth2 flow.
🔧 Temporary Workarounds
User Education
allEducate users to never post codes from third-party websites on their Scratch profiles.
🧯 If You Can't Patch
- Disable ScratchOAuth2 integration until patched
- Implement additional authentication checks before accepting OAuth2 codes
🔍 How to Verify
Check if Vulnerable:
Check if your ScratchOAuth2 version is before commit 9220c2a77eda3df37a84486ad722f1ad0985d8e7.Check Version:
git log --oneline | grep 9220c2a77eda3df37a84486ad722f1ad0985d8e7Verify Fix Applied:
Verify the commit 9220c2a77eda3df37a84486ad722f1ad0985d8e7 is applied and test that OAuth2 codes cannot be intercepted via user profile posting.📡 Detection & Monitoring
Log Indicators:
- Unusual OAuth2 login patterns
- Multiple failed login attempts from same IP
Network Indicators:
- Traffic to known malicious domains requesting Scratch usernames
SIEM Query:
source="oauth2_logs" AND (event="login_code_posted" OR event="unusual_auth_flow")🔗 References
- https://github.com/ScratchVerifier/ScratchOAuth2/commit/9220c2a77eda3df37a84486ad722f1ad0985d8e7
- https://github.com/ScratchVerifier/ScratchOAuth2/security/advisories/GHSA-gvpg-23fh-8g75
- https://github.com/ScratchVerifier/ScratchOAuth2/commit/9220c2a77eda3df37a84486ad722f1ad0985d8e7
- https://github.com/ScratchVerifier/ScratchOAuth2/security/advisories/GHSA-gvpg-23fh-8g75
