Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T18:18:21.143Z",
  "pubdate": "2026-11-06T18:18:21.143Z",
  "executiveSummary": "FreeScout prior to version 1.8.230 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing in the administrative job management interface.\nThe vulnerability originates from inadequate sanitization of serialized job data, allowing an unauthenticated attacker to inject malicious HTML payloads into the system's background processing queue.\nThe flaw occurs when an administrator accesses the /system/ajax-html/job_details/{id} endpoint to inspect failed background jobs.\nBecause the application fails to apply a robust Content Security Policy (CSP) or sufficient output encoding when rendering these job details, an attacker-controlled JavaScript payload executes within the security context of the administrator's session.\nThis allows for unauthorized actions performed on behalf of the administrator, effectively bypassing same-origin policy protections.\nExploitation requires a specific sequence of events: the injection of a crafted payload during a failed login attempt, the triggering of a SendAlert job, a subsequent failure of that job, and the manual inspection of the job by a privileged administrative user.\nSuccessful exploitation poses a critical risk to the confidentiality and integrity of the help desk system, enabling potential full account takeover or unauthorized data access.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling and insufficient sanitization of serialized job data stored within the application's failed_jobs queue.\nThe attack vector commences with an unauthenticated attacker providing a malicious HTML payload as the email value during a failed login attempt. This payload is subsequently ingested by the system and propagated into a SendAlert queued job during monitored user activity.\nIf the SendAlert job fails, the application persists the serialized job object into the failed_jobs database table.\nThe administrative endpoint at /system/ajax-html/job_details/{id} is designed to render details of these failed background tasks. During this rendering process, the application employs an insufficient blacklist-based sanitizer.\nThis blacklist fails to account for executable event-handler attributes (e.g., onerror, onload) embedded within the serialized HTML payload.\nWhen an administrator accesses the job_details endpoint as a top-level page, the application fails to enforce appropriate layout policies or strict output encoding. This creates an execution context where the browser interprets the attacker's embedded script tags or event handlers.\nThe JavaScript executes with the permissions of the administrative user, allowing the attacker to perform same-origin requests to the FreeScout instance, access administrative configuration, or hijack the session.\nThe vulnerability is specific to the /system/ajax-html/job_details/{id} endpoint when accessed as a top-level page; internal modal renderings were noted to be unaffected in tested configurations.\nAffected versions are all instances of FreeScout prior to 1.8.230. Mitigation requires upgrading to 1.8.230 or higher, where the underlying serialization and rendering logic have been hardened."
}