CVE-2024-29185
Freescout
CVE-2024-29185: A critical OS command injection vulnerability exists in FreeScout, a self-hosted help desk application. This flaw allows attackers to execute arbitrary operating system commands on the server if they know the application's App_Key. This vulnerability, found in versions prior to 1.8.128, stems from the insecure use of the shell_exec function in /public/tools.php with the unvalidated php_path parameter. Although the CVSS score is 9, SOCRadar's SVRS gives it a score of 30, suggesting that, while severe, it may not be as immediately critical as other vulnerabilities. Successful exploitation could lead to complete server compromise, as demonstrated by the extraction of the /etc/passwd file. Upgrade to version 1.8.128 or later to mitigate this security risk and prevent unauthorized server access.
Description
CVE-2024-29185 is an OS Command Injection vulnerability in FreeScout versions prior to 1.8.128. It allows an attacker to execute malicious OS commands on the server by manipulating the php_path parameter in the /public/tools.php source file. The SVRS for this CVE is 42, indicating a moderate risk.
Key Insights
- High Attack Complexity: The attacker needs to know the
App_Keyof the application to exploit this vulnerability. - Complete Server Compromise: Successful exploitation can lead to the complete compromise of the server hosting the FreeScout application.
- Active Exploits: Active exploits have been published for this vulnerability.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.
Mitigation Strategies
- Update FreeScout to version 1.8.128 or later.
- Restrict access to the /public/tools.php file.
- Implement input validation to prevent the execution of malicious OS commands.
- Monitor logs for suspicious activity and take appropriate action.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.