FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An authenticated administrator, or another authenticated user permitted to change mailbox connection settings or trigger module update or installation paths, can supply attacker-controlled URLs or hosts. The independent download and port-test sinks can reach encoded or otherwise uncovered loopback and internal addresses. The redirect-validation bypass additionally requires a configured whitelist that permits the original and final hosts while a restricted internal host appears only as an intermediate redirect hop. No unauthenticated SSRF path is established. The server can consequently contact loopback and internal services, provide a blind internal port oracle, and retrieve internal HTTP responses into application-controlled download sinks. This issue is fixed in version 1.8.230.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…escout/security/advisories/GHSA-6w8v-qp43-vg2h Diğer
• github.com/…ommit/09799fd4bcf731704bc2099a87bca0cf18d20acb Diğer
• github.com/…ommit/a4c587cf1fff87eae7d3e4f297fa4cc81ba28704 Diğer
• github.com/…scout-help-desk/freescout/releases/tag/1.8.230 Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:06Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-85742FreeScout: Conditional stored admin XSS via failed-job details
• 7,1 CVE-2026-103985FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
• 6,5 CVE-2026-103984FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
• 5,4 CVE-2026-85744FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass
• 5,3 CVE-2026-62850FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration a…
• 6,5 CVE-2026-62852FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key