Discuss Scratch

apple502j
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Critical Cross-site Scripting in Scratch
Cross-site scripting vulnerability was discovered in the SVG rendering engine for Scratch. This can lead to arbitrary code execution when a crafted project is opened on Scratch app (including Scratch Desktop).
This affects Scratch website, all versions of Scratch Desktop and other Scratch 3.0 mods or any applications using Scratch SVG Renderer. The attack is likely to be also possible on Scratch app for Android/Chromebook. A similar problem was also discovered on Forkphorus implementation of the rendering engine.

How to Prevent the Attack
・Scratch website: already patched.
・Scratch Desktop/Scratch app for Windows/macOS: DOWNLOAD AND INSTALL LATEST VERSION 3.17.1. Microsoft Store version is not updated, so use direct download.
・Mods: Pull latest commits of scratch-gui, delete node_modules and package-lock.json and run “npm install” again. If you are editing scratch-svg-renderer, a patch file is available: https://gist.github.com/apple502j/b1a4af80050175d0a23021a38b28ba57 (you need to run “npm install” after applying)
・Forkphorus website: already patched.
・Forkphorus mods: Pull latest commits.

Technical details
・CVE: CVE-2020-7750
・CVSS score: 9.6(Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
・CWE: CWE-79/Improper Neutralization of Input During Web Page Generation

How to get Security Update
Microsoft Store version users? Uninstall and switch to direct download!

macOS App Store
・It should be auto-updated.

Direct download
・Check https://scratch.mit.edu/download for details.

Last edited by apple502j (Oct. 22, 2020 03:46:39)


署名は、ディスカッションフォーラムの機能である。署名は、その人のすべての投稿の下部に追加される。署名は、BBCodeで記述できる。 署名を追加/変更/削除したい場合は、ディスカッションフォーラムのホームの一番下に行き、「Change your signature」を押す。署名の大きさは150pxまでである。これには、改行、画像を含む。- Japanese Scratch-Wiki 「署名
Ihatr
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Oh my, this sounds bad.

Just updated the app, so hopefully I'm safe now.




Jeffalo
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

i've updated my signature to spread the word. this is pretty dangerous stuff here apple, you're kinda like a superhero for finding all this!

my name is jeffalo, i develop scratch: addons, websites and tools to make your experience here better.










^ is this post a (bad) joke, unconstructive or otherwise useless to the conversation, if so please send a link on my profile
mtech22
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Should I just uninstall it or do I have to update it?

all toasters toast toast
or… do they?


duckboycool
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

mtech22 wrote:

Should I just uninstall it or do I have to update it?
It's probably worth reinstalling either way, but definitely do so if you have Microsoft Store version.

Last edited by duckboycool (Oct. 21, 2020 13:59:31)


I used to be active on the forums, but I have mostly moved past Scratch. I still do check my Scratch messages, so if you'd like to talk to me, just leave a comment on my profile. My main project on Scratch was Cookie Clicker, but my newest project is Snake Snake, a game based off of Snake, but with two snakes, and you can play either singleplayer or multiplayer.

mtech22
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

duckboycool wrote:

mtech22 wrote:

Should I just uninstall it or do I have to update it?
It's probably worth reinstalling either way, but definitely do so if you have Windows Store version.
I don't have the Windows Store version, so I just uninstalled it. I'm not currently using that device so if i have to reinstall it I will but if it's not I won't

all toasters toast toast
or… do they?


4096bits
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Okay, now I'm scared. I just uninstalled the Microsoft Store version of Scratch Desktop and installed the direct download version.

Jeffalo wrote:

i've updated my signature to spread the word. this is pretty dangerous stuff here apple, you're kinda like a superhero for finding all this!
I'll go ahead and warn people about this in my sig too when I have time to do so.

I've moved on to Snap!. Click here to learn more. No, it's not a joke.
-Accio-
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Is this still an issue if you only open your own projects with the app?

Hi There! I'm -Accio-

Potterhead | Ravenclaw | Forum Helper | SDS Curator | Science | Math

apple502j
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Only when you open bad projects.

署名は、ディスカッションフォーラムの機能である。署名は、その人のすべての投稿の下部に追加される。署名は、BBCodeで記述できる。 署名を追加/変更/削除したい場合は、ディスカッションフォーラムのホームの一番下に行き、「Change your signature」を押す。署名の大きさは150pxまでである。これには、改行、画像を含む。- Japanese Scratch-Wiki 「署名
MeowyTitan08
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Oh dear… The play store won't let me update to that version yet. I just uninstalled it.



Bluebatstar
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

I don't get it… what's going on? I did update the app, this sounds important, but I don't get it.


Scolipede's still my favourite Pokémon, but I love Inkay too, so I'm setting it as my PFP for a bit.
I'm probably going to share some teaser screenshots of my RPG soon, with some actual information. The game's still far from finished, but I'm back to creating it!
Jeffalo
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Bluebatstar wrote:

I don't get it… what's going on? I did update the app, this sounds important, but I don't get it.
someone sends you an sb3 (or you open a mallicous sb3) and somehow using some weird stuff it can run mallicous code that can do bad things

my name is jeffalo, i develop scratch: addons, websites and tools to make your experience here better.










^ is this post a (bad) joke, unconstructive or otherwise useless to the conversation, if so please send a link on my profile
Bluebatstar
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Jeffalo wrote:

Bluebatstar wrote:

I don't get it… what's going on? I did update the app, this sounds important, but I don't get it.
someone sends you an sb3 (or you open a mallicous sb3) and somehow using some weird stuff it can run mallicous code that can do bad things
Ok, I get it. I only use my own projects offline, but it's still a risk, nonetheless. I've updated now.


Scolipede's still my favourite Pokémon, but I love Inkay too, so I'm setting it as my PFP for a bit.
I'm probably going to share some teaser screenshots of my RPG soon, with some actual information. The game's still far from finished, but I'm back to creating it!
GachaN0nsense
Scratcher
500+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

I'll spread word. How did you even find out about this?

MOVING TO @NotDucki
Vercte
Scratcher
500+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

GachaN0nsense wrote:

I'll spread word. How did you even find out about this?
They're a bug hunter for websites, AKA a white-hat hacker.

be dry
DC382
Scratcher
500+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

What would the effects of said bug be?

My browser / operating system: ChromeOS (Linux) 13421.53.0, Chrome 86.0.4240.77, No Flash version detected.
Also, am I safe?

Pokemon Veteran who knows almost everything about main series, I can help if you need it. May Arceus increase your shiny odds.
Raycaster Editor
Did you know? You can do a (brackets instead of parentheses) (code)(/code) tag for something like this:
THIS IS A TEST! AND WHAT IS EVEN COOLER IS THAT (TAKES A MOMENT, ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER ANOTHER) 
IS THAT IT SCROLLS!
AND WITH ENTER YOU CAN GO TO A NEW
ROW
JUST
LIKE
THIS
!
But :) Emoticons don't work.
bywok
Scratcher
100+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

I haven't opened any .sb3 files other than my own… but I'll spread word
pokeshah
Scratcher
100+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

what this sounds serious though wat is going on

macOS: Press cmd+q twice
Windows: Press ctrl+alt+delete
Click Me!!!!!!!!!!!!!!!!!!!
4096bits
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

DC382 wrote:

What would the effects of said bug be?
I believe once you load any malicious Scratch 3 file in to any Scratch editor, code can be executed, which can be used to harm your computer.

I've moved on to Snap!. Click here to learn more. No, it's not a joke.
GoboSnack
Scratcher
100+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Let's spread the word!

My browser / operating system: Windows NT 10.0, Chrome 80.0.3987.116, No Flash version detected

Powered by DjangoBB

Standard | Mobile