Discuss Scratch

apple502j
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Critical Cross-site Scripting in Scratch
Cross-site scripting vulnerability was discovered in the SVG rendering engine for Scratch. This can lead to arbitrary code execution when a crafted project is opened on Scratch app (including Scratch Desktop).
This affects Scratch website, all versions of Scratch Desktop and other Scratch 3.0 mods or any applications using Scratch SVG Renderer. The attack is likely to be also possible on Scratch app for Android/Chromebook. A similar problem was also discovered on Forkphorus implementation of the rendering engine.

How to Prevent the Attack
・Scratch website: already patched.
・Scratch Desktop/Scratch app for Windows/macOS: DOWNLOAD AND INSTALL LATEST VERSION 3.17.1. Microsoft Store version is not updated, so use direct download.
・Mods: Pull latest commits of scratch-gui, delete node_modules and package-lock.json and run “npm install” again. If you are editing scratch-svg-renderer, a patch file is available: https://gist.github.com/apple502j/b1a4af80050175d0a23021a38b28ba57 (you need to run “npm install” after applying)
・Forkphorus website: already patched.
・Forkphorus mods: Pull latest commits.

Technical details
・CVE: CVE-2020-7750
・CVSS score: 9.6(Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
・CWE: CWE-79/Improper Neutralization of Input During Web Page Generation

How to get Security Update
Microsoft Store version users? Uninstall and switch to direct download!

macOS App Store
・It should be auto-updated.

Direct download
・Check https://scratch.mit.edu/download for details.

Last edited by apple502j (Oct. 22, 2020 03:46:39)


署名は、ディスカッションフォーラムの機能である。署名は、その人のすべての投稿の下部に追加される。署名は、BBCodeで記述できる。 署名を追加/変更/削除したい場合は、ディスカッションフォーラムのホームの一番下に行き、「Change your signature」を押す。署名の大きさは150pxまでである。これには、改行、画像を含む。- Japanese Scratch-Wiki 「署名
Ihatr
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Oh my, this sounds bad.

Just updated the app, so hopefully I'm safe now.
















Jeffalo
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

i've updated my signature to spread the word. this is pretty dangerous stuff here apple, you're kinda like a superhero for finding all this!

https://www.youtube.com/watch?v=PGZY-XWYqEo



adventures in fdreerf's comments episode 1





random images:

https://youtu.be/S5GfGbLhra8 <— ONLY GAMERS WILL WATCH













^ is this post a (bad) joke, unconstructive or otherwise useless to the conversation, if so please send a link on my profile
mtech22
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Should I just uninstall it or do I have to update it?

all toasters toast toast
duckboycool
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

mtech22 wrote:

Should I just uninstall it or do I have to update it?
It's probably worth reinstalling either way, but definitely do so if you have Microsoft Store version.

Last edited by duckboycool (Oct. 21, 2020 13:59:31)


I used to be active on the forums, but I have mostly moved past Scratch. I still do check my Scratch messages, so if you'd like to talk to me, just leave a comment on my profile. My main project on Scratch was Cookie Clicker, but my newest project is Snake Snake, a game based off of Snake, but with two snakes, and you can play either singleplayer or multiplayer.

mtech22
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

duckboycool wrote:

mtech22 wrote:

Should I just uninstall it or do I have to update it?
It's probably worth reinstalling either way, but definitely do so if you have Windows Store version.
I don't have the Windows Store version, so I just uninstalled it. I'm not currently using that device so if i have to reinstall it I will but if it's not I won't

all toasters toast toast
4096bits
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Okay, now I'm scared. I just uninstalled the Microsoft Store version of Scratch Desktop and installed the direct download version.

Jeffalo wrote:

i've updated my signature to spread the word. this is pretty dangerous stuff here apple, you're kinda like a superhero for finding all this!
I'll go ahead and warn people about this in my sig too when I have time to do so.

boop
-Accio-
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Is this still an issue if you only open your own projects with the app?

Hi There! I'm -Accio-

Potterhead | Ravenclaw | Forum Helper | SDS Curator | Science | Math

apple502j
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Only when you open bad projects.

署名は、ディスカッションフォーラムの機能である。署名は、その人のすべての投稿の下部に追加される。署名は、BBCodeで記述できる。 署名を追加/変更/削除したい場合は、ディスカッションフォーラムのホームの一番下に行き、「Change your signature」を押す。署名の大きさは150pxまでである。これには、改行、画像を含む。- Japanese Scratch-Wiki 「署名
MeowyTitan08
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Oh dear… The play store won't let me update to that version yet. I just uninstalled it.



Bluebatstar
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

I don't get it… what's going on? I did update the app, this sounds important, but I don't get it.


I bought a new Laptop charger, It works now.
Jeffalo
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Bluebatstar wrote:

I don't get it… what's going on? I did update the app, this sounds important, but I don't get it.
someone sends you an sb3 (or you open a mallicous sb3) and somehow using some weird stuff it can run mallicous code that can do bad things

https://www.youtube.com/watch?v=PGZY-XWYqEo



adventures in fdreerf's comments episode 1





random images:

https://youtu.be/S5GfGbLhra8 <— ONLY GAMERS WILL WATCH













^ is this post a (bad) joke, unconstructive or otherwise useless to the conversation, if so please send a link on my profile
Bluebatstar
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Jeffalo wrote:

Bluebatstar wrote:

I don't get it… what's going on? I did update the app, this sounds important, but I don't get it.
someone sends you an sb3 (or you open a mallicous sb3) and somehow using some weird stuff it can run mallicous code that can do bad things
Ok, I get it. I only use my own projects offline, but it's still a risk, nonetheless. I've updated now.


I bought a new Laptop charger, It works now.
GachaN0nsense
Scratcher
500+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

I'll spread word. How did you even find out about this?

This is my siggy! This is attached to the bottom of my posts but is not actually a part of it. You are allowed to advertise in your siggy- as long as it is appropriate!
I'm in school. I like to play Minecraft on the weekends. You'll typically find me on the Hypixel network. (/f DuckiSkeppy). I'm always on for at least 12 hours a day on the weekends, 0 hours a day on weekdays.

<⌐■_■::sensing> //this is Simon! He will protect me if any kumquats try to eat my siggy

I hope no evil kumquats eat my signature. Simon here will eat the kumquats before they eat my siggy- he's always hungry.

Oh, hi. What's this? Oh, just a lime. AHHH it's eating my signa

We will rise up and eat all signatures! You cannot stop us!

Simon has sadly not been trained to protect me from evil limes.

<♦σ♦::sensing> //this is Ollie! He will protect me if any limes try to eat my siggy again.
Vercte
Scratcher
500+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

GachaN0nsense wrote:

I'll spread word. How did you even find out about this?
They're a bug hunter for websites, AKA a white-hat hacker.

Do you know me? You probably don't but take my quiz.


I've been on Scratch for a year now!
DC382
Scratcher
500+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

What would the effects of said bug be?

My browser / operating system: ChromeOS (Linux) 13421.53.0, Chrome 86.0.4240.77, No Flash version detected.
Also, am I safe?

Make your own Pokemon Art…


Pokemon Veteran who knows almost everything about main series, I can help if you need it. May Arceus increase your shiny odds.

How many posts do I have?

Prep for the Crowned Tundra Here!

A great recipe list for the Cram-o-Matic here! *Its not mine, but honors to them*

Here are some facts about me!
My favorite color is #000D5E
My favorite Pokemon is Kyogre.
My least favorite Pokemon is Zubat.
My favorite trainer in the Pokemon Franchise is the Protagonist in ΩR/αS.
My least favorite trainer in the games/and anime is Ash. Allow me to explain. It takes this 10-11 year old going on 23 years to learn type matchups. I learned so much about Pokemon in 9 months that I memorized type matchups, can input actions like an extremely smart TAS, and have made a guide for every legendary, until CT * Battle Factory came along. S-S-SOFT RESET!!! *To the instant win song from Earthbound*
bywok
Scratcher
100+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

I haven't opened any .sb3 files other than my own… but I'll spread word

bywok wrote:

too many!!
pokeshah
Scratcher
100+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

what this sounds serious though wat is going on
4096bits
Scratcher
1000+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

DC382 wrote:

What would the effects of said bug be?
I believe once you load any malicious Scratch 3 file in to any Scratch editor, code can be executed, which can be used to harm your computer.

boop
GoboSnack
Scratcher
100+ posts

Critical Bug in SVG Renderer, Update Scratch App ASAP!

Let's spread the word!

GoboSnack
Yeeted from bio:
Age: 9
Gender: Male
Likes: Vectors, Art, Coding, Tech, 1950s stuff, birds, cars, SML
Dislikes: Homework, Baby stuff, getting banned
SML FANBOY FOR LIFE YO!

Magic!
:) Hi ya cant see me :P Link to nowhere [b]hi[/b]
#transrightsarehumanrights

Powered by DjangoBB

Standard | Mobile