Atomic Edge analysis of CVE-2024-13362:
This vulnerability is a reflected DOM-Based Cross-Site Scripting (XSS) issue found in the Freemius SDK up to version 2.10.1, which is used by multiple WordPress plugins and themes. The attack exploits insufficient input sanitization and output escaping in the ‘url’ parameter, allowing an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim’s browser when they click a crafted link. The CVSS score is 6.1 (Medium).
Root Cause:
The root cause is the lack of proper sanitization for the ‘url’ parameter before it is used in DOM manipulation. The vulnerable code path exists within the Freemius SDK’s handling of the ‘url’ parameter, where unsanitized user input is directly rendered into the page’s DOM without escaping. This occurs in files like primary-addon-for-elementor/elementor/lib/lib.php and various widget files such as nabasic-about-me.php, nabasic-about-us.php, nabasic-blog.php, nabasic-chart.php, nabasic-gallery.php, nabasic-image-compare.php, nabasic-section-title.php, nabasic-separator.php, nabasic-team.php, and nabasic-testimonials.php. The specific vulnerable pattern involves outputting variables directly into HTML attributes, class attributes, inline scripts, or data attributes without using esc_attr(), esc_html(), or wp_kses_post(). For example, in nabasic-about-me.php line 849, $aboutme_content is output directly without escaping. In nabasic-chart.php, JavaScript is generated with unsanitized user input embedded in the script tags.
Exploitation:
An attacker crafts a malicious URL containing a ‘url’ parameter with embedded JavaScript payload, such as: https://victim-site.com/?url=javascript:alert(‘XSS’) or a more complex payload using