CVE-2021-29437: Insufficient Information (NVD-CWE-noinfo)
value: ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be user and gets login code from ScratchOAuth2. 4. 3rd party site gives code to user and instructs them to post it on their profile. 5. User posts code on their profile, not knowing it is a ScratchOAuth2 login code. 6. 3rd party site completes login with ScratchOAuth2. 7. 3rd party site has full access to anything the user could do if they directly logged in. See referenced GitHub security advisory for patch notes and workarounds.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.8
Published: 2021-04-13T20:15Z
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Language: PHP
Files changed: i18n/en.json, i18n/qqq.json, includes/common/login.php, includes/special/SpecialScratchOAuth2.php
Commit date: 2021-04-13 11:48:24 +0100
Commit message: SECURITY: Mitigate MITM (GHSA-gvpg-23fh-8g75)

Prepend an anti-phishing message to the code itself warning about source
Add instructions to delete the comment afterwards to protect privacy

Diff: diff --git a/i18n/en.json b/i18n/en.json
index 509d32b..665e9e7 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -5,10 +5,12 @@
 	"soa2-login-title": "Login with Scratch",
 	"soa2-apps-title": "Manage your apps",
 	"soa2-scratch-username": "Scratch username:",
 	"soa2-invalid-username": "Invalid username: $1",
 	"soa2-vercode-explanation": "Please go to $1 and comment the code below:",
+	"soa2-vercode-explanation2": "For added privacy, delete your comment immediately after logging in here.",
+	"soa2-vercode": "Copy this paragraph (including both the code and this message). Only post this code if it came from {{SERVER}} | $1",
 	"soa2-your-profile": "your profile",
 	"soa2-next": "Next",
 	"soa2-login": "I have done so",
 	"soa2-login-failed": "Login failed. Please try again, and make sure you comment the code on your profile.",
 	"soa2-login-success": "You have successfully logged in. You may want to:\n* [[Special:SOA2Apps|Manage your applications]]\n* If you are an [[Special:ScratchOAuth2/admins|admin]], check the [[Special:SOA2Admin/approvals|name approval queue]]",
diff --git a/i18n/qqq.json b/i18n/qqq.json
index 477ad72..7e3e322 100644
--- a/i18n/qqq.json
+++ b/i18n/qqq.json
@@ -5,10 +5,12 @@
 	"soa2-login-title": "Title of Special:ScratchOAuth2/login",
 	"soa2-apps-title": "Title of Special:SOA2Apps",
 	"soa2-scratch-username": "Label for Scratch username field",
 	"soa2-invalid-username": "Error message for invalid username",
 	"soa2-vercode-explanation": "Instructions for user verification. $1 is the \"your profile\" link.",
+	"soa2-vercode-explanation2": "Instructions to delete the comment afterwards.",
+	"soa2-vercode": "A message prepended to the actual code to prevent man-in-the-middle attacks. $1 is the code.",
 	"soa2-your-profile": "Link text for \"your profile\"",
 	"soa2-next": "Next button text",
 	"soa2-login": "Login button text",
 	"soa2-login-failed": "Login failed error message",
 	"soa2-login-success": "Login success message, shown if no returnto was specified",
diff --git a/includes/common/login.php b/includes/common/login.php
index 06fa792..e5f5bbc 100644
--- a/includes/common/login.php
+++ b/includes/common/login.php
@@ -12,10 +12,11 @@ class SOA2Login {
 	 */
 	public static function gen_code( $session ) {
 		if (!$session->exists( 'soa2_scratch_code' )) {
 			$code = chunk_split(hash('sha256', random_bytes(32)), 5, ':');
 			$code = substr($code, 0, strlen($code) - 1); // chop off last colon
+			$code = wfMessage('soa2-vercode', $code)->text();
 			$session->set( 'soa2_scratch_code', $code );
 			$session->save();
 		}
 		return $session->get( 'soa2_scratch_code' );
 	}
diff --git a/includes/special/SpecialScratchOAuth2.php b/includes/special/SpecialScratchOAuth2.php
index 2aafe15..5461d0e 100644
--- a/includes/special/SpecialScratchOAuth2.php
+++ b/includes/special/SpecialScratchOAuth2.php
@@ -118,12 +118,13 @@ class SpecialScratchOAuth2 extends SpecialPage {
 		$out->addHTML(Html::rawElement(
 			'p', [],
 			wfMessage('soa2-vercode-explanation')->rawParams($profile)->parse()
 		));
 		$out->addHTML(Html::rawElement('p', [], Html::element(
-			'code', [], $codes['code']
+			'textarea', [], $codes['code']
 		)));
+		$out->addWikiMsg('soa2-vercode-explanation2');
 		$out->addHTML(Html::rawElement('p', [], Html::submitButton(
 			wfMessage('soa2-login')->plain(), []
 		)));
 		$out->addHTML(Html::closeElement('form'));
 	}

Vulnerable code: 			'code', [], $codes['code']
Fixed code: 	"soa2-vercode-explanation2": "For added privacy, delete your comment immediately after logging in here.",
	"soa2-vercode": "Copy this paragraph (including both the code and this message). Only post this code if it came from {{SERVER}} | $1",
	"soa2-vercode-explanation2": "Instructions to delete the comment afterwards.",
	"soa2-vercode": "A message prepended to the actual code to prevent man-in-the-middle attacks. $1 is the code.",
			$code = wfMessage('soa2-vercode', $code)->text();
			'textarea', [], $codes['code']
		$out->addWikiMsg('soa2-vercode-explanation2');