CVE-2024-29184

FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. In this case, the Support Agent User can inject malicious scripts into their signature, which will then be executed when viewed by the Administrator. The application protects users against XSS attacks by enforcing a CSP policy, the CSP Policy is: `script-src 'self' 'nonce-abcd' `. The CSP policy only allows the inclusion of JS files that are present on the application server and doesn't allow any inline script or script other than nonce-abcd. The CSP policy was bypassed by uploading a JS file to the server by a POST request to /conversation/upload endpoint. After this, a working XSS payload was crafted by including the uploaded JS file link as the src of the script. This bypassed the CSP policy and XSS attacks became possible. The impact of this vulnerability is severe as it allows an attacker to compromise the FreeScout Application. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. Alternatively, the attacker can elevate the privileges of a low-privileged user to Administrator, further compromising the security of the application. Attackers can steal sensitive information such as login credentials, session tokens, personal identifiable information (PII), and financial data. The vulnerability can also lead to defacement of the Application. Version 1.8.128 contains a patch for this issue.

• CWE-79
• CWE-79

• https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-fffc-phh8-5h4vExploit, Vendor Advisory
• https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-fffc-phh8-5h4vExploit, Vendor Advisory

Published

Mar 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29179phpMyFAQ is an open source FAQ web application for PHP 8.1+ …4.8
• CVE-2024-2918Improper input validation in PAM JIT elevation feature in De…3.6
• CVE-2024-29180Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-m…7.5
• CVE-2024-29181Strapi is an open-source content management system. Prior to…3.5
• CVE-2024-29182Collabora Online is a collaborative online office suite base…6.1
• CVE-2024-29183OpenRASP is a RASP solution that directly integrates its pro…6.1
• CVE-2024-29185FreeScout is a self-hosted help desk and shared mailbox. Ver…9
• CVE-2024-29186Bref is an open-source project that helps users go serverles…5.3
• CVE-2024-29187WiX toolset lets developers create installers for Windows In…7.3
• CVE-2024-29188WiX toolset lets developers create installers for Windows In…7.9
• CVE-2024-29189PyAnsys Geometry is a Python client library for the Ansys Ge…7.8
• CVE-2024-2919The Gutenberg Blocks by Kadence Blocks – Page Builder Featur…5.4