FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the php_path parameter is being executed as an OS command by the shell_exec function, without validating it. This allows an adversary to execute malicious OS commands on the server. A practical demonstration of the successful command injection attack extracted the /etc/passwd file of the server. This represented the complete compromise of the server hosting the FreeScout application. This attack requires an attacker to know the `App_Key` of the application. This limitation makes the Attack Complexity to be High. If an attacker gets hold of the `App_Key`, the attacker can compromise the Complete server on which the application is deployed. Version 1.8.128 contains a patch for this issue.
The php_path parameter passed to the /public/tools.php file is passed directly without any validation to the shell_exec() function, allowing the attacker to inject and execute arbitrary operating system commands. A necessary condition is knowledge of the application key App_Key, which classifies the attack complexity as high (High). A practical demonstration of the vulnerability showed the ability to read the /etc/passwd file, confirming complete server compromise.
An attacker who knows the application's App_Key can execute arbitrary system commands on the server and gain full control of the machine hosting FreeScout, including access to sensitive data and the ability to further operate within the infrastructure.
FreeScout should be updated to version 1.8.128 or later, which contains a patch eliminating the vulnerability. Additionally, it is recommended to rotate the App_Key and restrict network access to the /public/tools.php file.
FreeScout in versions earlier than 1.8.128
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HFreescout
APPFreescout< 1.8.128
Related vulnerabilities
FreeScout: Stored XSS w szablonach powiadomień e-mail umożliwia przejęcie kont
FreeScout: bypass zabezpieczeń uploadu pliku prowadzący do RCE
FreeScout: przewidywalny token uwierzytelniający umożliwia przejęcie konta
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download to...
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's `Helper::s...