Exploiting Scratch with a malicious image (2021)
1–9 of 9 posts
Re: Exploiting Scratch with a malicious image (2021)
#2How on earth?
> The answer is perhaps surprising - SVG files can contain JavaScript, CSS and load external content
There you are
Re: Exploiting Scratch with a malicious image (2021)
#3How on earth? > The answer is perhaps surprising - SVG files can contain JavaScript, CSS and load external content There you are
No, this is not the reason.
HTML also can contain Javascript, CSS and load external content.
Re: Exploiting Scratch with a malicious image (2021)
#4This is probably a common flaw in a lot of applications with a lot of complexity layered below the main product.
Electron applications are a prime example of this, since there is a whole webbrowser underneath and HTML doing HTML things is expected behavior for the browser, but not the application above. One can probably attribute the whole log4j debacle to the same fault, in that the "common" developer is unable to understand all complexity and quirks their software ships with (difference being, that a browser engine is far more complex than a logger)
I remember a time where "Scrach" wasn't a Electron application, but a native (I think?) Linux application. Obv. there can be bugs in dependencies too (rsvg, libpng, etc.) but they different and tend to not be as easily exploitable as these kind of Electron/HTML->V8 bugs are.
Re: Exploiting Scratch with a malicious image (2021)
#5This is probably a common flaw in a lot of applications with a lot of complexity layered below the main product. Electron applications are a prime example of this, since there is a whole webbrowser underneath and HTML doing HTML things is expected behavior for the browser, but not the application above. One can probably attribute the whole log4j debacle to the same fault, in that the "common" developer is unable to u…
[deleted]
Re: Exploiting Scratch with a malicious image (2021)
#6How on earth? > The answer is perhaps surprising - SVG files can contain JavaScript, CSS and load external content There you are
Technically, the issue is not that SVG allows active content. It is that untrusted XML is being inserted in the DOM by Scratch.
Arbitrary SVG content can be safely embedded as an image, either via the img tag or as a background image.
Re: Exploiting Scratch with a malicious image (2021)
#7Re: Exploiting Scratch with a malicious image (2021)
#8This is one of my favourite class of vulnerabilities.
Many applications and saas products that deal with images are susceptible to this vector because often image handling isn't a core business just a means to an end, so isn't always given the priority or deference it deserves.
The SVG format by spec is a swiss army knife that contains all kinds of opportunities for leveraging poor handling of the data it can contain.
Re: Exploiting Scratch with a malicious image (2021)
#9This is probably a common flaw in a lot of applications with a lot of complexity layered below the main product. Electron applications are a prime example of this, since there is a whole webbrowser underneath and HTML doing HTML things is expected behavior for the browser, but not the application above. One can probably attribute the whole log4j debacle to the same fault, in that the "common" developer is unable to u…
Originally Scratch was a Smalltalk program and then in 2.0 it switched to Flash/Actionscript. So it has never really been "native". Although I'm not a big fan of Electron it does fit what the Scratch project needs perfectly as they need to be able to run Scratch in a web browser to reach more kids and schools. In this day and age HTML5/JS/CSS is the only way to do that. The fact that Electron lets them offer an offline editor is just a nice bonus.