CVE-2020-14000: Scratch vm Remote Code Execution Vulnerability

CRITICAL
Advisory Identifier: GHSA-vc9j-fhvv-8vrf
Share
CVSS 9.8
CWE-502
Published
Advisory Summary

CVE-2020-14000 is a CRITICAL (CVSS 9.8) remote code execution vulnerability (CWE-502: Deserialization of Untrusted Data) affecting Scratch vm libraries in the npm ecosystem. The issue involves remote code execution in scratch-vm. Remediation is available by upgrading affected packages to version 0.2.0-prerelease.20200714185213.

CVE-2020-14000 at a Glance

CVE Identifier CVE-2020-14000
GHSA Identifier GHSA-vc9j-fhvv-8vrf
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-502: Deserialization of Untrusted Data
Affected Product Scratch vm
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2020-14000

To remediate this vulnerability, upgrade all affected Scratch vm dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

scratch-vm fixed: 0.2.0-prerelease.20200714185213 
npm install scratch-vm@0.2.0-prerelease.20200714185213
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls scratch-vm

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2020-14000, inspect your project dependencies using npm:

npm ls scratch-vm

Analyze the terminal output to locate any version of Scratch vm in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.2.0-prerelease.20200714185213), your application is affected.

Note: The npm ls scratch-vm command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-502: Deserialization of Untrusted Data, where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In Scratch vm, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

MIT Lifelong Kindergarten Scratch scratch-vm before `0.2.0-prerelease.20200714185213` loads extension URLs from untrusted project.json files with certain `_` characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is `getExtensionIdForOpcode` in serialization/sb3.js. The use of `_` is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. **NOTE**: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.

CVE-2020-14000 Affected Scratch vm Versions

1 component(s)
Fixed Versions:
0.2.0-prerelease.20200714185213
Product / Package Ecosystem Affected Versions Fixed Version
scratch-vm
npm/scratch-vm
npm
< 0.2.0-prerelease.20200714185213
0.2.0-prerelease.20200714185213

References

NVD — CVE-2020-14000 NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14000
Scratch vm Source Repository REPOSITORY
https://github.com/LLK/scratch-vm/pull/2476
Scratch vm Source Repository REPOSITORY
https://github.com/LLK/scratch-vm/pull/2476/commits/90b9da45f4084958535338d1c4d71a22d6136aab
Scratch vm Source Repository REPOSITORY
https://github.com/LLK/scratch-vm
scratch.mit.edu/discuss/topic/42290... WEB
https://scratch.mit.edu/discuss/topic/422904/?page=1#post-4223443

Frequently Asked Questions

What is CVE-2020-14000?
CVE-2020-14000 is a security vulnerability in Scratch vm involving Remote Code Execution in scratch-vm under CWE-502: Deserialization of Untrusted Data.
Which Scratch vm versions are affected?
Affected versions include releases prior to 0.2.0-prerelease.20200714185213 across affected packages: scratch-vm.
What version fixes CVE-2020-14000?
Upgrading to 0.2.0-prerelease.20200714185213 (or the latest patched release for your respective branch) resolves the vulnerability.
Is scratch-vm affected?
Yes, scratch-vm is affected in releases prior to 0.2.0-prerelease.20200714185213. Upgrade your dependency to 0.2.0-prerelease.20200714185213 or later.
What is the CVSS score of CVE-2020-14000?
CVE-2020-14000 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2020-14000?
CVE-2020-14000 is classified under CWE-502: Deserialization of Untrusted Data (The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.).
How can I check npm dependencies for CVE-2020-14000?
Run the dependency tree command: 'npm ls scratch-vm'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vc9j-fhvv-8vrf",
  "modified" : "2023-09-12T18:20:33Z",
  "published" : "2020-07-27T19:55:52Z",
  "aliases" : [ "CVE-2020-14000" ],
  "summary" : "Remote Code Execution in scratch-vm",
  "details" : "MIT Lifelong Kindergarten Scratch scratch-vm before `0.2.0-prerelease.20200714185213` loads extension URLs from untrusted project.json files with certain `_` characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is `getExtensionIdForOpcode` in serialization/sb3.js. The use of `_` is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. \n\n**NOTE**: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "scratch-vm"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.2.0-prerelease.20200714185213"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.2.0-prerelease.20200709173451"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-14000"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/LLK/scratch-vm/pull/2476"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/LLK/scratch-vm/pull/2476/commits/90b9da45f4084958535338d1c4d71a22d6136aab"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/LLK/scratch-vm"
  }, {
    "type" : "WEB",
    "url" : "https://scratch.mit.edu/discuss/topic/422904/?page=1#post-4223443"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-502" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-07-27T19:53:24Z",
    "nvd_published_at" : null
  }
}