FreeScout Incorrect Authorization Vulnerability via Save Draft

FreeScout is a self-hosted help desk and shared mailbox platform. Prior to version 1.8.215, a vulnerability exists related to authorization controls when the APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS setting is enabled. Specifically, the save_draft AJAX endpoint lacks proper authorization checks. This allows an attacker to potentially bypass intended access restrictions and create drafts within conversations that they should not be able to access, leading to unauthorized modification or viewing of conversation data. This vulnerability was addressed in version 1.8.215.

Attack Chain

1. Attacker identifies a FreeScout instance running a version prior to 1.8.215 with APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS enabled.
2. Attacker authenticates to the FreeScout instance with a valid, but unauthorized user account.
3. Attacker identifies the conversation ID of a conversation they are not assigned to and cannot normally access via the UI.
4. Attacker crafts a POST request to the /index.php?m=conversations&a=save_draft endpoint, including the conversation ID and the draft content they wish to create.
5. The server, lacking proper authorization checks on the save_draft endpoint, accepts the POST request.
6. A draft is created within the targeted conversation, associated with the attacker’s user account.
7. The attacker, or potentially other unauthorized users who later gain access to the attacker’s account, can view or modify the drafted content, potentially exfiltrating sensitive information.

Impact

Successful exploitation of this vulnerability allows unauthorized users to create drafts within conversations they are not assigned to. This could lead to the unauthorized viewing or modification of sensitive information contained within the conversations, potentially leading to data breaches or compliance violations. The vulnerability affects FreeScout instances running versions prior to 1.8.215 with the specific APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS setting enabled.

Recommendation

• Upgrade FreeScout to version 1.8.215 or later to remediate the vulnerability (references: https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215).
• Monitor web server logs for POST requests to the /index.php?m=conversations&a=save_draft endpoint originating from unusual IP addresses or user agents using the Sigma rule provided below.
• Implement web application firewall (WAF) rules to filter or block unauthorized POST requests to the vulnerable endpoint.