Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in FreeScout, a PHP-based help desk and shared inbox system, which could allow an unauthenticated attacker to gain administrative access. The issue lies in how the system handles user setup invitations, potentially enabling an attacker to reset the email and password of an existing user account, including administrator accounts, without needing any prior credentials or session information. The main concern is confirming if FreeScout is in use and, if so, assessing exposure.
- Unauthenticated attackers can take over accounts.
- Crucial for protecting support and admin access.
- Confirm FreeScout usage and assess exposure.
Attack Path
How an attacker could exploit the issue
An attacker can target any FreeScout installation by exploiting a weakness in how user invitations are handled. By crafting a specific request to a public setup endpoint, an unauthenticated attacker can bypass authentication checks, manipulate account details, and log in as an existing user. This could allow an attacker to take over an agent's account or even an administrator's account if one was created through an invitation process.
- No authentication is needed.
- Specially crafted request to user setup.
- Account takeover and impersonation risk.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to reset the email and password of the lowest-ID activated FreeScout account. This account might be a support agent or an administrator, enabling the attacker to impersonate that user. The attack is possible when FreeScout is deployed on MySQL or MariaDB and when the `invite_sent_at` parameter is manipulated to bypass time-based checks.
- Support agent or administrator accounts.
- Resetting credentials via a public endpoint.
- Unauthorized access and impersonation.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and platform teams are likely responsible for FreeScout instances. The first practical step is to identify all FreeScout deployments, confirm their accessibility from the internet, and determine if they are actively used for critical business functions. Once identified, the accountable owner must be engaged to plan remediation based on the assessed risk, which may involve vendor coordination and maintenance window planning.
- Own the FreeScout instance.
- Verify external reachability and business criticality.
- Plan and coordinate vendor-provided fix deployment.
