Prototype Pollution in `matter-js`

Prototype Pollution in matter-js

Summary

matter-js (<= 0.20.0) is vulnerable to Prototype Pollution via matter-js.Body.create, matter-js.Common.clone, matter-js.Common.extend, matter-js.Common.set, matter-js.Composite.create, matter-js.Detector.create, matter-js.Engine.create, matter-js.Engine.merge, matter-js.Grid.create, matter-js.Pairs.create, matter-js.Runner.create, matter-js.World.create.

• CWE: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes
• Severity: Critical (CVSS 9.8)
• Weekly Downloads: 180,120
• npm: https://www.npmjs.com/package/matter-js

Description

The function(s) matter-js.Body.create, matter-js.Common.clone, matter-js.Common.extend, matter-js.Common.set, matter-js.Composite.create, matter-js.Detector.create, matter-js.Engine.create, matter-js.Engine.merge, matter-js.Grid.create, matter-js.Pairs.create, matter-js.Runner.create, matter-js.World.create in matter-js do not properly restrict modifications to Object.prototype. When processing user-controlled input, an attacker can inject properties via __proto__ or constructor.prototype keys, polluting the prototype of all JavaScript objects in the application.

Attack vectors: __proto__`, `constructor.prototype

Proof of Concept

const target = require('matter-js');

// 1. Pollute Object.prototype
const malicious = JSON.parse('{"__proto__":{"polluted":"yes"}}');
matter-js.Body.create({}, malicious);

// 2. Verify pollution
const obj = {};
console.log(obj.polluted); // "yes" - prototype is polluted
console.log('Vulnerable:', obj.polluted === 'yes');

Impact

Successful exploitation allows an attacker to:

• Remote Code Execution (RCE) via child_process spawn injection or vm sandbox escape

Remediation

Add key filtering to prevent prototype pollution:

function isSafe(key) {
  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}

Or use Object.create(null) for target objects to prevent prototype chain access.

References

• CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
• OWASP Prototype Pollution
• https://www.npmjs.com/package/matter-js