FreeScout vulnerabilities

FreeScout is a free help desk and shared inbox built with the Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers, but the backend conversation_change_customer action accepts any supplied customer_email.

FreeScout prior to version 1.8.217 had a vulnerability in the Helper::sanitizeRemoteUrl() function that improperly validated URLs after HTTP redirects. An attacker could exploit this vulnerability to redirect traffic to internal HTTP services that would normally be blocked.

FreeScout prior to version 1.8.217 allows users with updateAutoReply permission to store an XSS payload in the auto-reply message. The payload is rendered unescaped in the auto-reply email sent to customers.

In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.

FreeScout prior to version 1.8.217 has a vulnerability in the /user-setup/{hash} endpoint that accepts a 60-character random invite_hash to set a new user's password. The lack of expiration check allows for unauthorized account takeover long after the invite was issued.

In FreeScout prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email.

FreeScout, a free help desk built with Laravel, does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.

FreeScout prior to version 1.8.224 has a vulnerability in the App Logs feature that allows an authenticated attacker to download arbitrary server-local files readable by the PHP process via manipulation of the dl parameter.

FreeScout before version 1.8.224 has an incomplete denylist of dangerous file extensions, missing the .pht extension. An authenticated agent can upload a .pht web shell, leading to remote code execution on the web server.

A Prototype Pollution vulnerability in the getQueryParam function in /public/js/main.js in FreeScout. The fix in version 1.8.139 is incomplete, allowing attacks via nested URL keys. Fixed in version 1.8.223.

Vulnerability in FreeScout before version 1.8.223. An unauthenticated attacker can inject a message into any existing support conversation by sending an email with a crafted In-Reply-To header. The message appears as a customer reply, and the conversation is automatically reopened.

Vulnerability in FreeScout (versions prior to 1.8.221) in the attachment download mechanism. An unauthenticated attacker can download any attachment created by an older version because token authentication is skipped for attachments with legacy token type.

FreeScout prior to version 1.8.219 has a vulnerability in the open tracking endpoint GET /thread/read/{conversation_id}/{thread_id} allowing unauthenticated attackers to enumerate valid conversation and thread IDs and modify thread state without authentication.

FreeScout prior to 1.8.221 allows a non-admin user to permanently delete an internal note from any conversation, even after access to the mailbox has been revoked, due to missing mailbox membership check in ThreadPolicy::delete. Fixed in 1.8.221.

FreeScout prior to 1.8.221 has a missing mailbox membership check in ThreadPolicy::edit, allowing a user with PERM_EDIT_CONVERSATIONS to rewrite thread content after being removed from the mailbox. Fixed in 1.8.221.

FreeScout prior to 1.8.220 has a vulnerability in the email processing pipeline where thread and user IDs are extracted from Message-ID without HMAC verification. An attacker can spoof an agent's address and inject messages treated as agent replies, which are automatically forwarded to customers.

FreeScout prior to version 1.8.219 has a vulnerability in the password reset endpoint that returns visually distinct responses depending on whether the submitted email address belongs to an existing user account. This allows unauthenticated attackers to enumerate valid helpdesk agent email addresses.

FreeScout, a help desk system built with Laravel, has a bug in the checkIpByMask() function that checks if the input IP contains a '/' character. Plain IP addresses never contain '/', so the function always returns false without checking CIDR ranges. Private ranges 10.0.0.0/8 and 172.16.0.0/12 remain unprotected. Affects versions prior to 1.8.211.

FreeScout before version 1.8.211 has a host header manipulation vulnerability that allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. A fix is available in version 1.8.211.

FreeScout versions 1.8.185 and earlier contain a deserialization of untrusted data vulnerability that allows authenticated attackers with knowledge of the application's APP_KEY to achieve remote code execution. The vulnerability is exploited via the endpoint /help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}, where customer_id and timestamp parameters are processed through the decrypt function in app/Helper.php without proper validation, leading to deserialization of malicious PHP objects.