Synopsis
In July 2021, Researchers at Tenable discovered a prototype pollution vulnerability in the Wishpond javascript library (connect.js), which could result in a cross-site scripting attack against sites which deployed/made use of the library. An attacker could exploit this vulnerability by tricking a user into opening a malicious link, thereby allowing them to execute javascript in the context of the user's browser on the affected domain.
Proof of Concept:
For any affected site which leveraged the connect.js library from cdn.wishpond.net/connect.js, a prototype pollution could be achieved, in the general sense, with a payload like the following:
https://<affected-site>/?__proto__[polluted]=true
At the time of discovery, a cross site scripting attack could be achieved in sites using the Wishpond library via the jQuery .off() method, if jQuery was available on the site, by way of polluting String.prototype:
https://<affected-site>/?__proto__[preventDefault]=x&__proto__[handleObj]=x&__proto__[delegateTarget]=<img/src/onerror%3Dalert(document.domain)>
Solution
The issue appears to have been mitigated by either an intentional or unintentional fix. Please contact Wishpond for further information.Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team