CVE-2025-48475

Executive Summary

CVE-2025-48475 is a missing authorization vulnerability in FreeScout, a self-hosted help desk and shared mailbox application. The flaw allows an authenticated user with no access to any mailboxes or conversations to view and edit all clients in the system. This bypasses the intended limit_user_customer_visibility setting, which is designed to restrict client visibility. The vulnerability has been patched in version 1.8.180.

Supply Chain & Package Security

FreeScout is a PHP-based application distributed via GitHub and Docker. The vulnerability exists in the core application logic, not in a third-party package. However, organizations using FreeScout should verify the integrity of their installation and ensure they are running version 1.8.180 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (unauthorized client data access)
• Integrity Impact: Low (unauthorized client data modification)
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but allows unauthorized access to client data, which could include sensitive personal information.

Deep Dive & Mechanics

The vulnerability stems from a missing authorization check in the client management functionality. FreeScout has a setting limit_user_customer_visibility that, when enabled, should restrict which clients a user can see based on their mailbox assignments. However, in versions prior to 1.8.180, this check is not performed when a user has no mailbox or conversation access.

Root Cause: The code that retrieves and displays clients does not verify the user's permissions against the limit_user_customer_visibility setting when the user has no mailbox assignments. This allows a user with minimal privileges to enumerate and modify all clients.

Attack Scenario:

1. An attacker gains access to a low-privileged FreeScout account (e.g., a support agent with no mailbox access).
2. The attacker navigates to the client management page.
3. The system returns a list of all clients, bypassing the intended visibility restriction.
4. The attacker can view client details and potentially edit them.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.8.180):

// In ClientController.php or similar
public function index()
{
    $clients = Client::all(); // No authorization check
    return view('clients.index', compact('clients'));
}

Patched Code (1.8.180):

// In ClientController.php or similar
public function index()
{
    $user = auth()->user();
    if ($user->hasSetting('limit_user_customer_visibility')) {
        $clients = $user->getAccessibleClients(); // Proper check
    } else {
        $clients = Client::all();
    }
    return view('clients.index', compact('clients'));
}

The patch adds a check for the limit_user_customer_visibility setting and restricts client access accordingly.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A FreeScout instance (version < 1.8.180)
• A user account with no mailbox or conversation access

Exploitation Steps:

1. Log in to FreeScout with the low-privileged account.
2. Navigate to /clients or the client management endpoint.
3. Observe that all clients are visible, including those that should be restricted.
4. Use browser developer tools or a proxy (e.g., Burp Suite) to modify client data via PUT/POST requests.

Example Request:

GET /clients HTTP/1.1
Host: freescout.example.com
Cookie: [session_cookie]

Response:

{
  "clients": [
    {"id": 1, "name": "Client A", "email": "clienta@example.com"},
    {"id": 2, "name": "Client B", "email": "clientb@example.com"}
  ]
}

Blue Team

Detection:

• Monitor for access to /clients or /clients/* endpoints by users with no mailbox assignments.
• Look for unusual patterns in client data access logs.

Hunting Query:

SELECT * FROM access_logs
WHERE endpoint LIKE '/clients%'
AND user_id IN (
    SELECT id FROM users WHERE mailbox_count = 0
);

Indicators of Compromise (IOCs)

• Network: HTTP requests to /clients or /clients/* from low-privileged users.
• Logs: Access logs showing client enumeration by users with no mailbox access.
• System: Unauthorized modifications to client records in the database.

Detection Engineering

YARA Rule

rule CVE_2025_48475_FreeScout_Client_Access
{
    meta:
        description = "Detects vulnerable FreeScout versions with missing client authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48475"
    strings:
        $vuln_func = "Client::all()" nocase
        $vuln_query = "SELECT * FROM clients" nocase
    condition:
        any of them
}

Sigma Rule

title: FreeScout Unauthorized Client Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to access client data without proper authorization in FreeScout
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: freescout
detection:
    selection:
        endpoint: "/clients*"
        user_role: "agent"
        mailbox_count: 0
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-48475 FreeScout Unauthorized Client Access";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/clients"; http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2025-48475;
)

Remediation & Mitigation

Immediate:

1. Upgrade FreeScout to version 1.8.180 or later.
2. If upgrade is not possible, manually apply the patch from the GitHub repository.

Long-term:

1. Implement role-based access control (RBAC) for all client-facing endpoints.
2. Regularly audit user permissions and mailbox assignments.
3. Enable and enforce the limit_user_customer_visibility setting.

Workaround:

• Disable the limit_user_customer_visibility setting if not needed, or ensure all users have appropriate mailbox assignments.

Valters IT
DevSecOps & Cyber Threat Intelligence