Remote Code Execution Vulnerability in MIT Lifelong Kindergarten Scratch VM

CVE-2020-14000

What is CVE-2020-14000?

The Scratch VM, developed by MIT Lifelong Kindergarten, is vulnerable to remote code execution due to its handling of untrusted project.json files. Specifically, versions prior to 0.2.0-prerelease.20200714185213 allow for malicious URLs to load scripts that get executed in the context of a worker. This flaw arises because the presence of certain characters, such as '_', bypasses a protection mechanism that would typically prevent deserialization attacks. As a result, attackers can inject code through crafted project.json files, posing a serious threat to user security. However, the hosted service at scratch.mit.edu is not impacted due to the absence of worker scripts.

References