| 제목 | Node.js phaser3-rex-plugins 1.80.17 Prototype Pollution |
|---|
| 설명 | A prototype pollution vulnerability exists in phaser3-rex-plugins 1.80.17.
The package contains a path-based SetValue helper that is reachable through higher-level public BehaviorTree Blackboard APIs. Public APIs such as Blackboard#set(key, value, treeID, nodeID) and setData obtain a memory object and pass the caller-controlled key directly into SetValue(memory, key, value). The SetValue helper splits dotted key paths, traverses intermediate objects, and assigns the final value without rejecting dangerous path segments such as proto, constructor, or prototype.
When an attacker-controlled path contains a proto segment, traversal can resolve to Object.prototype. The final assignment then writes attacker-controlled properties onto Object.prototype, causing prototype pollution. Newly created plain objects may subsequently inherit polluted properties.
A secondary exposed route exists through Tree#setValue(keys, value) / setRefPath(...).setValue(...), which also forwards caller-controlled path keys into SetValue.
Affected version:
phaser3-rex-plugins 1.80.17
Impact:
Prototype pollution through public behavior-tree / blackboard APIs. Exploitability depends on applications passing untrusted or partially trusted blackboard keys, behavior-tree state keys, save-game fields, level definitions, mod/plugin configuration, or remote JSON-driven key paths into the affected APIs.
Root cause:
Path traversal and assignment logic does not reject prototype-related path segments before lookup, traversal, or write.
Recommended fix:
Reject proto, constructor, and prototype path segments before any lookup, traversal, or assignment. Avoid traversing inherited objects. Add regression tests for SetValue, Blackboard#set/setData, and Tree#setValue. |
|---|
| 원천 | ⚠️ https://github.com/rexrainbow/phaser3-rex-notes/issues/572 |
|---|
| 사용자 | wjm3 (UID 99672) |
|---|
| 제출 | 2026. 07. 09. PM 02:55 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 23. PM 06:00 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394563 [rexrainbow phaser3-rex-notes 까지 1.80.17 BehaviorTree Blackboard Data Interface SetValue.js SetValue key 권한 상승] |
|---|
| 포인트들 | 20 |
|---|