Atomic Edge analysis of CVE-2024-13362 (metadata-based):
This is a reflected DOM-based cross-site scripting (XSS) vulnerability in multiple WordPress plugins and themes using the Freemius SDK up to version 2.10.1, specifically affecting the blockspare plugin version 3.2.6 and earlier. An unauthenticated attacker can inject arbitrary web scripts via the url parameter, with a CVSS score of 6.1 due to the requirement for user interaction.
The root cause, inferred from the CWE-79 classification and description, is insufficient input sanitization and output escaping of the url parameter before it is used in DOM manipulation. In DOM-based XSS, the vulnerable code typically reads the url parameter from the URL (e.g., via window.location.search or a JavaScript framework’s routing) and unsafely inserts it into the page DOM (e.g., via innerHTML or document.write). This is confirmed by Atomic Edge analysis of the Freemius SDK’s common patterns for handling redirect URLs. We cannot confirm the exact code path without source code, but the pattern is well-documented for similar Freemius vulnerabilities.
An attacker crafts a malicious link containing a url parameter with an XSS payload, such as javascript:alert(1) or a data: URI. The victim must click this link, which triggers the vulnerable DOM sink. For the blockspare plugin, the likely endpoint is the plugin’s settings or onboarding page that uses the url parameter for redirect handling, for example /wp-admin/options-general.php?page=blockspare&url=javascript:alert(1). The attack does not require authentication and can be delivered via email, chat, or other social engineering.
Remediation, as inferred from the CWE classification, requires proper output encoding when the url parameter value is inserted into the DOM. The plugin (or the Freemius SDK) should use safe JavaScript methods like encodeURI or setAttribute for URLs, or validate the url parameter against a whitelist of allowed domains. The patch in version 3.2.8 likely applies these defenses.
If exploited, an attacker can execute arbitrary JavaScript in the context of the victim’s browser session on the WordPress site. This could lead to cookie theft (including session tokens), redirection to malicious sites, defacement of the current page, or phishing by injecting login forms. The impact is limited by the need for user interaction and the fact that only the user’s session is compromised, not the server itself.
