Wishpond Connect.js Javascript Library Prototype Pollution

In July 2021, Researchers at Tenable discovered a prototype pollution vulnerability in the Wishpond javascript library (connect.js), which could result in a cross-site scripting attack against sites which deployed/made use of the library. An attacker could exploit this vulnerability by tricking a user into opening a malicious link, thereby allowing them to execute javascript in the context of the user's browser on the affected domain.

Proof of Concept:

For any affected site which leveraged the connect.js library from cdn.wishpond.net/connect.js, a prototype pollution could be achieved, in the general sense, with a payload like the following:

https://<affected-site>/?__proto__[polluted]=true

At the time of discovery, a cross site scripting attack could be achieved in sites using the Wishpond library via the jQuery .off() method, if jQuery was available on the site, by way of polluting String.prototype:

https://<affected-site>/?__proto__[preventDefault]=x&__proto__[handleObj]=x&__proto__[delegateTarget]=<img/src/onerror%3Dalert(document.domain)>