FreeScout Stored XSS to Privilege Escalation After CSP Bypass
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. In this case, the Support Agent User can inject malicious scripts into their signature, which will then be executed when viewed by the Administrator. The application protects users against XSS attacks by enforcing a CSP policy, the CSP Policy is: `script-src 'self' 'nonce-abcd' `. The CSP policy only allows the inclusion of JS files that are present on the application server and doesn't allow any inline script or script other than nonce-abcd. The CSP policy was bypassed by uploading a JS file to the server by a POST request to /conversation/upload endpoint. After this, a working XSS payload was crafted by including the uploaded JS file link as the src of the script. This bypassed the CSP policy and XSS attacks became possible. The impact of this vulnerability is severe as it allows an attacker to compromise the FreeScout Application. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-29184
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 00:58 UTC · Revision 1
Source evidence
FreeScout Stored XSS to Privilege Escalation After CSP Bypass
core-osv · Original sourcePublished 22 Mar 2024, 17:01 UTC
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. In this case, the Support Agent User can inject malicious scripts into their signature, which will then be executed when viewed by the Administrator. The application protects users against XSS attacks by enforcing a CSP policy, the CSP Policy is: `script-src 'self' 'nonce-abcd' `. The CSP policy only allows the inclusion of JS files that are present on the application server and doesn't allow any inline script or script other than nonce-abcd. The CSP policy was bypassed by uploading a JS file to the server by a POST request to /conversation/upload endpoint. After this, a working XSS payload was crafted by including the uploaded JS file link as the src of the script. This bypassed the CSP policy and XSS attacks became possible. The impact of this vulnerability is severe as it allows an attacker to compromise the FreeScout Application. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add
osv:CVE-2024-29184
Complete source record
{
"id": "fc92371e88caf78b8a5aaa5c3cf51dcf8099204c552e2ded212c5b808d6cf6ed",
"url": "https://osv.dev/vulnerability/CVE-2024-29184",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "FreeScout Stored XSS to Privilege Escalation After CSP Bypass",
"summary": "FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. In this case, the Support Agent User can inject malicious scripts into their signature, which will then be executed when viewed by the Administrator. The application protects users against XSS attacks by enforcing a CSP policy, the CSP Policy is: `script-src 'self' 'nonce-abcd' `. The CSP policy only allows the inclusion of JS files that are present on the application server and doesn't allow any inline script or script other than nonce-abcd. The CSP policy was bypassed by uploading a JS file to the server by a POST request to /conversation/upload endpoint. After this, a working XSS payload was crafted by including the uploaded JS file link as the src of the script. This bypassed the CSP policy and XSS attacks became possible. The impact of this vulnerability is severe as it allows an attacker to compromise the FreeScout Application. By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add ",
"evidence": "osv:CVE-2024-29184",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2024-29184",
"aliases": [
"CVE-2024-29184",
"GHSA-fffc-phh8-5h4v"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/freescout-help-desk/freescout",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "67de1109feb8ea942c6c9a5b3f78fd8e1fe8cc78"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.8.128"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.8.128"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.8.127",
"1.8.126",
"1.8.125",
"1.8.124",
"1.8.123",
"1.8.122",
"1.8.121",
"1.8.120",
"1.8.119",
"1.8.118",
"1.8.117",
"1.8.116",
"1.8.115",
"1.8.114",
"1.8.113",
"1.8.112",
"1.8.111",
"1.8.110",
"1.8.109",
"1.8.108",
"1.8.107",
"1.8.106",
"1.8.105",
"1.8.104",
"1.8.103",
"1.8.102",
"1.8.101",
"1.8.100",
"1.8.99",
"1.8.98",
"1.8.97",
"1.8.96",
"1.8.95",
"1.8.94",
"1.8.93",
"1.8.92",
"1.8.91",
"1.8.90",
"1.8.89",
"1.8.88",
"1.8.87",
"1.8.86",
"1.8.85",
"1.8.84",
"1.8.83",
"1.8.82",
"1.8.81",
"1.8.80",
"1.8.79",
"1.8.78",
"1.8.77",
"1.8.76",
"1.8.75",
"1.8.74",
"1.8.73",
"1.8.72",
"1.8.71",
"1.8.70",
"1.8.69",
"1.8.68",
"1.8.67",
"1.8.66",
"1.8.65",
"1.8.63",
"1.8.62",
"1.8.61",
"1.8.60",
"1.8.59",
"1.8.58",
"1.8.57",
"1.8.56",
"1.8.55",
"1.8.54",
"1.8.53",
"1.8.52",
"1.8.51",
"1.8.50",
"1.8.49",
"1.8.48",
"1.8.47",
"1.8.46",
"1.8.45",
"1.8.44",
"1.8.43",
"1.8.42",
"1.8.41",
"1.8.40",
"1.8.39",
"1.8.38",
"1.8.37",
"1.8.36",
"1.8.35",
"1.8.34",
"1.8.33",
"1.8.32",
"1.8.31",
"1.8.30",
"1.8.29",
"1.8.28",
"1.8.27",
"1.8.26",
"1.8.25",
"1.8.24",
"1.8.23",
"1.8.22",
"1.8.21",
"1.8.20",
"1.8.19",
"1.8.18",
"1.8.17",
"1.8.16",
"1.8.15",
"1.8.14",
"1.8.13",
"1.8.12",
"1.8.11",
"1.8.10",
"1.8.9",
"1.8.8",
"1.8.7",
"1.8.6",
"1.8.5",
"1.8.4",
"1.8.3",
"1.8.2",
"1.8.1",
"1.8.0",
"1.7.30",
"1.7.28",
"1.7.27",
"1.7.26",
"1.7.25",
"1.7.24",
"1.7.23",
"1.7.22",
"1.7.21",
"1.7.20",
"1.7.19",
"1.7.18",
"1.7.17",
"1.7.16",
"1.7.15",
"1.7.14",
"1.7.13",
"1.7.12",
"1.7.11",
"1.7.10",
"1.7.9",
"1.7.7",
"1.7.6",
"1.7.5",
"1.7.4",
"1.7.3",
"1.7.2",
"1.7.1",
"1.7.0",
"1.6.20",
"1.6.19",
"1.6.18",
"1.6.17",
"1.6.16",
"1.6.15",
"1.6.14",
"1.6.13",
"1.6.12",
"1.6.11",
"1.6.10",
"1.6.9",
"1.6.8",
"1.6.7",
"1.6.6",
"1.6.5",
"1.6.4",
"1.6.3",
"1.6.2",
"1.6.1",
"1.6.0",
"1.5.15",
"1.5.14",
"1.5.13",
"1.5.12",
"1.5.11",
"1.5.10",
"1.5.9",
"1.5.8",
"1.5.7",
"1.5.6",
"1.5.5",
"1.5.4",
"1.5.3",
"1.5.2",
"1.5.1",
"1.5.0",
"1.4.12",
"1.4.11",
"1.4.10",
"1.4.9",
"1.4.8",
"1.4.7",
"1.4.6",
"1.4.4",
"1.4.3",
"1.4.2",
"1.4.1",
"1.4.0",
"1.3.19",
"1.3.18",
"1.3.17",
"1.3.16",
"1.3.15",
"1.3.14",
"1.3.13",
"1.3.12",
"1.3.11",
"1.3.10",
"1.3.9",
"1.3.8",
"1.3.7",
"1.3.6",
"1.3.5",
"1.3.4",
"1.3.3",
"1.3.2",
"1.3.1",
"1.3.0",
"1.2.6",
"1.2.5",
"1.2.4",
"1.2.3",
"1.2.2",
"1.2.1",
"1.2.0",
"1.1.10",
"1.1.9",
"1.1.8",
"1.1.7",
"1.1.6",
"1.1.5",
"1.1.4",
"1.1.3",
"1.1.2",
"1.1.1",
"1.1.0",
"1.0.9",
"1.0.8",
"1.0.7",
"1.0.6",
"1.0.5",
"1.0.4",
"1.0.3",
"1.0.2",
"1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29184.json"
}
}
],
"modified": "2026-10-28T02:30:45.578486719Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29184.json",
"https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-fffc-phh8-5h4v",
"https://nvd.nist.gov/vuln/detail/CVE-2024-29184"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29184.json"
}
},
"related_cves": [
{
"value": "CVE-2024-29184",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 513667,
"published_at": "2024-03-22T17:01:01.799+00:00"
}