Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T17:18:33.157Z",
  "pubdate": "2026-11-06T17:18:33.157Z",
  "executiveSummary": "FreeScout versions prior to 1.8.225 contain a critical vulnerability in the tools.php maintenance endpoint, which lacks proper authentication and access-control mechanisms.\nThis flaw exposes the application to unauthorized information disclosure and credential brute-forcing attacks.\nAttackers can leverage this endpoint to perform file and directory enumeration by analyzing server response variances.\nFurthermore, the absence of rate limiting, per-session throttling, or CAPTCHA implementation on this endpoint allows for unrestricted automated attempts to guess application-level secrets, including the application-key and database-password.\nThe vulnerability poses a severe risk to confidentiality and integrity, as successful exploitation could lead to full system compromise or unauthorized access to sensitive database configurations.\nExploitation requires network access to the target instance but does not necessitate prior authentication, significantly lowering the barrier for remote adversaries.",
  "technicalDetails": "The root cause of the vulnerability lies in an improper access-control boundary enforced on the maintenance utility endpoint, specifically identified as tools.php within the FreeScout application. This endpoint, intended for administrative maintenance, fails to validate the identity or authorization level of the requesting entity, rendering it globally accessible.\nThe vulnerability manifests through two primary attack vectors. The first is an information disclosure primitive: by manipulating attacker-controlled path values submitted to the tools.php endpoint, an adversary can observe discrepancies in HTTP response patterns. These variations reveal the existence of specific files or directories on the underlying file system, facilitating reconnaissance and path discovery of the application environment.\nThe second, and arguably more critical, vector involves the validation logic for sensitive configuration secrets. The endpoint provides a mechanism to verify application-key and database-password candidates. Due to a complete absence of security controls—specifically the lack of rate limiting, per-session request throttling, and CAPTCHA mechanisms—the endpoint is susceptible to high-speed, automated brute-force attacks. An adversary can script repetitive requests to systematically iterate through potential keys and passwords until a successful match is identified.\nStep-by-step exploitation flow: 1. The attacker targets the public-facing tools.php endpoint. 2. For directory enumeration, the attacker injects various path payloads and monitors HTTP response codes or content length differences to map the server's structure. 3. For credential recovery, the attacker initiates a volumetric brute-force attack against the authentication parameters. 4. Because the server does not restrict request frequency or utilize challenge-response mechanisms, the attacker can verify thousands of permutations in a short duration. 5. Upon successful validation of an application-key or database-password, the attacker gains the credentials necessary to escalate privileges, access the database directly, or compromise the application's integrity by gaining administrative control. The vulnerability is present in all FreeScout versions before 1.8.225."
}