Threat Intelligence Database

FreeScout versions prior to 1.8.224 have a vulnerability in the file upload endpoint where rate limiting is not enforced. This allows any user to send excessive upload requests, potentially overloading the database and causing denial of service. The issue is fixed in version 1.8.224.

FreeScout versions prior to 1.8.224 contain a critical vulnerability in the user setup endpoint that allows an unauthenticated attacker to overwrite the email and password of the lowest-id activated user account and authenticate as that user. This occurs due to improper handling of case sensitivity and trailing spaces in the invite_hash field on MySQL/MariaDB, combined with a flawed decryption check that allows bypassing expiry validation. The vulnerability is fixed in version 1.8.224.

FreeScout versions prior to 1.8.224 contain a path traversal vulnerability in the App Logs feature. This flaw allows an attacker with access to the App Logs route and the ability to forge a valid Laravel-encrypted parameter to download arbitrary files readable by the PHP process, bypassing intended directory restrictions. The vulnerability is fixed in version 1.8.224.

FreeScout versions prior to 1.8.224 have an incomplete denylist for dangerous file uploads, missing the .pht extension. Authenticated users can upload .pht files, which are executed by default Apache PHP handlers, allowing remote code execution as the web server user. This vulnerability bypasses a previous fix that did not cover .pht files. Version 1.8.224 includes an updated fix to address this issue.

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix.

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.