Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Vulnerability Summary

The Freemius SDK (versions <= 2.10.1), bundled with the Restaurant & Cafe Addon for Elementor plugin, is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS). The vulnerability exists because the Freemius JavaScript logic (specifically in the pricing and contact modules) extracts the url parameter from the browser's location and sinks it into a dangerous DOM property (like window.location.href, iframe.src, or anchor.href) without proper validation or sanitization.

This allows an unauthenticated attacker to construct a malicious URL that, when clicked by a logged-in administrator, executes arbitrary JavaScript in the context of the WordPress admin dashboard.

Attack Vector Analysis

• Vulnerable Page: Any admin page registered by Freemius, typically the Pricing, Contact, or Support pages.
• Admin Page Slugs (Inferred):
  • restaurant-cafe-addon-for-elementor-pricing
  • restaurant-cafe-addon-for-elementor-contact
  • restaurant-cafe-addon-for-elementor-account
• Vulnerable Parameter: url
• Authentication: Unauthenticated (to craft the link), but requires a logged-in Administrator to visit the link (Reflected).
• Preconditions: The "Restaurant & Cafe Addon for Elementor" plugin must be installed and activated, and the Freemius SDK must be initialized (usually requires visiting the plugin's settings once).

Code Flow

1. Entry Point: The Administrator navigates to wp-admin/admin.php?page=restaurant-cafe-addon-for-elementor-pricing&url=javascript:alert(document.domain).
2. Script Execution: WordPress loads the Freemius admin page, which enqueues freemius/assets/js/pricing/freemius-pricing.js (as seen in the source).
3. Parameter Extraction: The Freemius JavaScript uses a utility function (often a wrapper around URLSearchParams or a custom regex parser) to read the url parameter from window.location.search.
4. The Sink: The script uses this url value to:
   • Set the src of a "checkout" or "pricing" <iframe>.
   • Set the href of a "Try Again" or "Back" link.
   • Set window.location.href during a redirect logic.
5. Execution: If the payload is javascript:alert(1), the browser executes the code when the iframe loads or the link is clicked.

Nonce Acquisition Strategy

This is a Reflected DOM XSS, which typically does not require a WordPress nonce because the vulnerability is in the client-side processing of URL parameters. The server simply renders the page and enqueues the script; the malicious logic happens entirely in the browser using data already present in the URL.

If the page itself were restricted by a nonce (highly unusual for a top-level admin.php page), the agent would need to:

1. Navigate to the main plugin settings page.
2. Extract any necessary nonces from the localized JS object (e.g., window.fs_common_data?.nonce).
3. However, for this specific CVE, the url parameter is processed directly from the URL by the SDK's JavaScript.

Exploitation Strategy

1. Target Identification: Determine the exact admin page slug for the Freemius Pricing or Contact page.
2. Payload Construction: Use a simple JavaScript URI payload: javascript:alert(document.domain).
3. HTTP Request: Use http_request to simulate an admin clicking the link. Since this is DOM-based, we must use browser_navigate to allow the JavaScript to execute and the sink to be reached.
4. Verification: Check if the browser triggers an alert or if the payload is reflected in a dangerous attribute in the DOM.

Step-by-Step Plan:

1. Login as Admin: Authenticate to the WordPress instance.
2. Discover Slug: Use wp eval to find the registered Freemius slugs.
3. Navigate: Use browser_navigate to visit:
   http://localhost:8080/wp-admin/admin.php?page=[SLUG]-pricing&url=javascript:alert(window.origin)
4. Interact: If the XSS is tied to an iframe or link, the agent may need to wait for the page to load or use browser_click on a "Contact" or "Upgrade" button.
5. Observe: Check for the execution of the alert or the presence of the payload in the src of an iframe.

Test Data Setup

1. Install Plugin: wp plugin install restaurant-cafe-addon-for-elementor --version=1.5.8 --activate.
2. Initialize Freemius: Navigate to the plugin settings page once to ensure Freemius is initialized and options are saved.
3. Role: Perform the exploit as an Administrator.

Expected Results

A successful exploit will result in the url parameter being placed into a DOM element that executes JavaScript.

• Iframe Sink: <iframe src="javascript:alert(document.domain)">
• Link Sink: <a href="javascript:alert(document.domain)">
• Location Sink: window.location.href = "javascript:alert(document.domain)"

Verification Steps

1. Browser Console: Use browser_eval to check if a specific "canary" variable or alert was triggered.
2. DOM Inspection: Use browser_eval to inspect the Freemius iframe or links:

   document.querySelector('iframe[src*="javascript:"]').src
   

Alternative Approaches

If the pricing page is not active (e.g., requires a specific configuration), try the contact page:
wp-admin/admin.php?page=restaurant-cafe-addon-for-elementor-contact&url=javascript:alert(1)

If javascript: URIs are blocked by a basic check, attempt attribute breakout:
url="><img src=x onerror=alert(1)>

Check for the payload in localized data:

browser_eval("window.fs_pricing_config")

If the url is reflected in fs_pricing_config.url, the XSS may occur when that object is used to build the UI.