Horizon Alert
Summary of the vulnerability and why it matters
A security issue in FreeScout allows unauthorized users to take over accounts, even months or years after an invitation was issued. This happens because account setup links do not expire, and sensitive information like these links can leak through various means. If an administrative account is compromised, this could lead to a full system takeover.
- Permanently compromise user accounts.
- Gain unauthorized access to sensitive support information.
- Escalate privileges to administrator level.
Attack Path
How an attacker could exploit the issue
An attacker can take over any FreeScout account if they obtain a leaked user setup hash. The vulnerability allows anyone to set a password for an account using an expired invite hash, enabling account takeover. If the leaked hash belongs to an administrator, the attacker gains full control of the help desk.
- Unauthenticated access is required.
- Target the user-setup endpoint.
- Hash must be leaked.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in FreeScout allows unauthenticated account takeover via indefinitely valid invite hashes, a significant risk for customer-facing help desk systems. Attackers would likely find this appealing due to the potential for full system compromise, especially if an admin account can be taken over. The risk is amplified by common hash leakage vectors like email forwarding or exposed logs.
- Exploitation hinges on leaked hashes.
- Patch available in version 1.8.217.
- KEV listing is not present.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching FreeScout instances to version 1.8.217 to address the indefinite account takeover vulnerability via leaked invite hashes. If immediate patching is not feasible, implement stricter access controls and monitoring for the user-setup endpoint.
- Update FreeScout to version 1.8.217.
- Monitor for unexpected user creation or password resets.
- Restrict access to user-setup endpoints.
