CVE-2025-48478

Executive Summary

CVE-2025-48478 is a critical mass assignment vulnerability in FreeScout, a free self-hosted help desk and shared mailbox application. The vulnerability exists in versions prior to 1.8.180 and allows an unauthenticated attacker to manipulate all fields of the User object during user creation due to insufficient input validation. This can lead to privilege escalation, unauthorized access, and full compromise of the application. The vulnerability has been patched in version 1.8.180.

Supply Chain & Package Security

FreeScout is a PHP-based application. The vulnerability is in the core application code, not in a specific package manager (NPM, PyPI, Go, Ruby). However, administrators should ensure that all dependencies are up-to-date and that the application is deployed securely.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): None - The attacker does not need any authentication.
• User Interaction (UI): None - No user action is required.
• Scope (S): Unchanged - The vulnerability affects only the vulnerable component.
• Confidentiality (C): High - Full read access to all data is possible.
• Integrity (I): High - Full write access to all data is possible.
• Availability (A): High - Full control over the application, including potential denial of service.

Threat Level: Critical. The vulnerability allows an attacker to create a user with arbitrary attributes, potentially granting administrative privileges.

Deep Dive & Mechanics

The vulnerability is a mass assignment issue in the user creation functionality of FreeScout. In Laravel-based applications (which FreeScout is built on), mass assignment occurs when an attacker can pass unexpected parameters to a model's create() or update() methods. The $fillable array in the User model defines which attributes are allowed to be mass-assigned. However, due to insufficient input validation, an attacker can manipulate all fields in the $fillable array during user creation.

The attack flow:

1. An attacker sends a POST request to the user registration endpoint.
2. The request includes additional parameters beyond the expected ones (e.g., role, is_admin, permissions).
3. The application does not properly filter these parameters, allowing them to be passed to the User model's create() method.
4. The attacker can set themselves as an administrator or grant themselves elevated privileges.

The vulnerable code likely uses User::create($request->all()) or similar, which passes all input parameters to the model without proper validation.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.8.180):

// In UserController or similar
public function store(Request $request)
{
    $user = User::create($request->all());
    // ...
}

Patched Code (1.8.180+):

// In UserController or similar
public function store(Request $request)
{
    $validatedData = $request->validate([
        'email' => 'required|email|unique:users',
        'password' => 'required|min:8',
        'name' => 'required|string|max:255',
        // Only allow specific fields
    ]);
    $user = User::create($validatedData);
    // ...
}

The patch adds explicit validation to only allow specific fields to be passed to the model, preventing mass assignment of unauthorized attributes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable FreeScout instance (version < 1.8.180)
• Network access to the registration endpoint

Exploitation Steps:

1. Identify the registration endpoint (e.g., /register or /api/register).
2. Craft a POST request with additional parameters to escalate privileges.

Example Exploit (cURL):

curl -X POST https://target.com/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "attacker@example.com",
    "password": "Password123!",
    "name": "Attacker",
    "role": "admin",
    "is_admin": true
  }'

Expected Outcome: The attacker creates a user with administrative privileges, gaining full control over the help desk system.

Blue Team

Detection:

• Monitor for unusual parameters in registration requests.
• Look for requests that include fields like role, is_admin, permissions, or other non-standard attributes.
• Alert on successful registration of users with elevated privileges.

Hunting:

• Search logs for registration requests with unexpected parameters.
• Review user accounts created outside of normal business hours.
• Check for users with administrative roles that were not created through the admin panel.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /register or /api/register with parameters like role, is_admin, permissions.
• Unusual user-agent strings or IP addresses during registration.

Host IOCs:

• User accounts with elevated privileges created through the registration endpoint.
• Log entries showing mass assignment errors or warnings.
• Unexpected changes to user roles or permissions.

File IOCs:

• Modified user model files (e.g., app/User.php) if the attacker attempts to change the $fillable array.
• New user entries in the database with suspicious attributes.

Detection Engineering

YARA Rule

rule CVE_2025_48478_MassAssignment {
    meta:
        description = "Detects mass assignment attempts in FreeScout user creation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48478"
    strings:
        $s1 = "role" ascii nocase
        $s2 = "is_admin" ascii nocase
        $s3 = "permissions" ascii nocase
        $s4 = "User::create" ascii nocase
        $s5 = "request->all()" ascii nocase
    condition:
        any of ($s1, $s2, $s3) and ($s4 or $s5)
}

Sigma Rule

title: FreeScout Mass Assignment Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-48478 by sending mass assignment parameters during user registration
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/register'
            - '/api/register'
        cs-uri-query|contains:
            - 'role'
            - 'is_admin'
            - 'permissions'
    condition: selection
falsepositives:
    - Legitimate admin user creation through API
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48478 FreeScout Mass Assignment Attempt"; flow:to_server; content:"POST"; http_method; content:"/register"; http_uri; content:"role"; http_client_body; nocase; content:"is_admin"; http_client_body; nocase; content:"permissions"; http_client_body; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FreeScout to version 1.8.180 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with unexpected parameters.
3. Review all existing user accounts for unauthorized privilege escalation.

Long-term Mitigations:

1. Implement strict input validation for all user-facing endpoints.
2. Use Laravel's $fillable or $guarded properties correctly and ensure all controllers validate input.
3. Conduct regular security audits and penetration testing.
4. Monitor for similar vulnerabilities in other parts of the application.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/register" "phase:2,id:1000002,deny,status:403,msg:'Mass assignment attempt blocked',chain"
SecRule REQUEST_BODY "@rx (role|is_admin|permissions)" "t:none,t:urlDecodeUni"

Valters IT