FreeScout fixes a security flaw discovered by Webcracy

Webcracy's security research group, the software company based in the Locarno area, has found a vulnerability in the open source helpdesk FreeScout. It was discovered by Liam Giannini, and the project's maintainers fixed it in version 1.8.248, released together with advisory GHSA-vcgj-6qfr-7qr6 on 17 October.

FreeScout is ticketing software written in PHP with the Laravel framework, used as a self-hosted alternative to services such as Help Scout or Zendesk. To show agents in real time who is reading a conversation, the program uses a component called Polycast, which receives a periodic request from the browser at the address POST /polycast/receive.

The problem was in the method handling that request, processConvView(). The code read the conversation identifier sent by the browser and used it without checking its format or verifying that the user was allowed to see that conversation. The server then created a cache entry and added the same identifier to an array shared by the whole installation, called conv_view, which is read and rewritten in full on every request and stays valid for twenty minutes.

One account was enough to slow everyone down

By sending enough made-up identifiers, an authenticated user could make that array grow and make every subsequent write heavier, including those from other agents. A scheduled command that runs every minute to remove expired entries amplified the effect, creating more work for the database and the real-time notification system. The result was a slowdown of the helpdesk for all users, without the attacker needing administrator privileges and without access to other conversations' data.

GitHub rated the flaw as moderate severity, with a CVSS 3.1 score of 6.5, in the category of uncontrolled resource consumption issues. At the time of publication, no CVE had yet been assigned to it.

Webcracy found the problem by analysing the source code of FreeScout 1.8.247, then verified it in an isolated lab environment with a limited number of requests, without generating load traffic or testing real installations. In the fixed version, the server only accepts valid numeric identifiers and checks, before any cache write, that the user can actually see the specified conversation.

The same 1.8.248 release fixes three other flaws: one that made earlier conversations visible to agents who should only see the ones assigned to them, one that allowed opening multiple sessions by redeeming the same invite in parallel, and an issue in a third-party library used by FreeScout. Anyone running an earlier version should update, after first backing up the database and installed modules.

Webcracy spends part of its time reviewing open source software it installs for its clients, and reports vulnerabilities it finds to the maintainers.