CVE-2021-29437 (published 2021-04-13T20:15Z)

ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be user and gets login code from ScratchOAuth2. 4. 3rd party site gives code to user and instructs them to post it on their profile. 5. User posts code on their profile, not knowing it is a ScratchOAuth2 login code. 6. 3rd party site completes login with ScratchOAuth2. 7. 3rd party site has full access to anything the user could do if they directly logged in. See referenced GitHub security advisory for patch notes and workarounds.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.8, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ScratchVerifier/ScratchOAuth2
commit_details: repo_url: https://github.com/ScratchVerifier/ScratchOAuth2
author: Kenny2github
author_date: 2021-04-13 11:48:24+01:00
msg: SECURITY: Mitigate MITM (GHSA-gvpg-23fh-8g75)

Prepend an anti-phishing message to the code itself warning about source
Add instructions to delete the comment afterwards to protect privacy
repository: repo_url: https://github.com/ScratchVerifier/ScratchOAuth2
repo_name: ScratchVerifier/ScratchOAuth2
description: Since Scratch has no native OAuth, "Fine, I'll do it myself."
repo_language: PHP
owner: ScratchVerifier
file_changes: filename: en.json
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,8 @@
 	"soa2-scratch-username": "Scratch username:",
 	"soa2-invalid-username": "Invalid username: $1",
 	"soa2-vercode-explanation": "Please go to $1 and comment the code below:",
+	"soa2-vercode-explanation2": "For added privacy, delete your comment immediately after logging in here.",
+	"soa2-vercode": "Copy this paragraph (including both the code and this message). Only post this code if it came from {{SERVER}} | $1",
 	"soa2-your-profile": "your profile",
 	"soa2-next": "Next",
 	"soa2-login": "I have done so",

programming_language: Go
filename: qqq.json
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,8 @@
 	"soa2-scratch-username": "Label for Scratch username field",
 	"soa2-invalid-username": "Error message for invalid username",
 	"soa2-vercode-explanation": "Instructions for user verification. $1 is the \"your profile\" link.",
+	"soa2-vercode-explanation2": "Instructions to delete the comment afterwards.",
+	"soa2-vercode": "A message prepended to the actual code to prevent man-in-the-middle attacks. $1 is the code.",
 	"soa2-your-profile": "Link text for \"your profile\"",
 	"soa2-next": "Next button text",
 	"soa2-login": "Login button text",

programming_language: Go
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -14,6 +14,7 @@ class SOA2Login {
 		if (!$session->exists( 'soa2_scratch_code' )) {
 			$code = chunk_split(hash('sha256', random_bytes(32)), 5, ':');
 			$code = substr($code, 0, strlen($code) - 1); // chop off last colon
+			$code = wfMessage('soa2-vercode', $code)->text();
 			$session->set( 'soa2_scratch_code', $code );
 			$session->save();
 		}

programming_language: PHP
filename: SpecialScratchOAuth2.php
change_type: ModificationType.MODIFY
diff: @@ -120,8 +120,9 @@ class SpecialScratchOAuth2 extends SpecialPage {
 			wfMessage('soa2-vercode-explanation')->rawParams($profile)->parse()
 		));
 		$out->addHTML(Html::rawElement('p', [], Html::element(
-			'code', [], $codes['code']
+			'textarea', [], $codes['code']
 		)));
+		$out->addWikiMsg('soa2-vercode-explanation2');
 		$out->addHTML(Html::rawElement('p', [], Html::submitButton(
 			wfMessage('soa2-login')->plain(), []
 		)));

programming_language: PHP