CVE-2024-29185

Freescout command injection

9.0 CRITICALEPSS 1.73%

Published22 Mar 2024

Description

FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the php_path parameter is being executed as an OS command by the shell_exec function, without validating it. This allows an adversary to execute malicious OS commands on the server. A practical demonstration of the successful command injection attack extracted the /etc/passwd file of the server. This represented the complete compromise of the server hosting the FreeScout application. This attack requires an attacker to know the `App_Key` of the application. This limitation makes the Attack Complexity to be High. If an attacker gets hold of the `App_Key`, the attacker can compromise the Complete server on which the application is deployed. Version 1.8.128 contains a patch for this issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Freescout< 1.8.128

Remediation

Fixed in

Freescout≥ 1.8.128

Frequently asked

Is CVE-2024-29185 being actively exploited?

CVE-2024-29185 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.73%.

How severe is CVE-2024-29185?

CVE-2024-29185 has a CVSS 3.1 base score of 9.0, rated critical. EPSS estimates a 1.73% probability of exploitation.

Which products are affected by CVE-2024-29185?

Affected products include Freescout.

How do I fix CVE-2024-29185?

Upgrade affected software to a fixed version, for example Freescout 1.8.128 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-29185 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.