An authenticated cross-site scripting vulnerability in FreeScout versions prior to 1.8.213 permits attackers to steal administrative CSRF tokens and perform unauthorized administrative actions.

The application fails to adequately sanitize <style> tags within the mailbox signature field, allowing authenticated users with mailbox access to inject CSS. This flaw enables the exfiltration of CSRF tokens from administrators or other agents who view the affected conversation, facilitating account takeover or unauthorized state changes.

The exploitation of this vulnerability poses a significant risk to organizational integrity by allowing an attacker to escalate privileges from an agent to an administrator. Successful execution leads to full control over the help desk environment, including the ability to modify security settings, reset passwords, or access sensitive customer communications. With a CVSS score of 8.1, this issue represents a high-severity threat to confidentiality and integrity.

Immediate Action: Update the FreeScout installation to version 1.8.213 or later to apply the necessary sanitization logic for style tags.

Proactive Monitoring: Review audit logs for suspicious administrative actions, such as unexpected account creations or modifications to sensitive system configurations, originating from internal user accounts.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts the execution of inline styles and unauthorized scripts, and ensure that Web Application Firewalls are configured to inspect and block suspicious CSS injection patterns in POST requests.

Public Exploit Available: Unknown.

Given the potential for complete administrative account takeover, organizations using FreeScout must prioritize this update. Administrators should verify their current version immediately and apply the patch to mitigate the risk of privilege escalation. Failure to address this flaw leaves the help desk infrastructure vulnerable to internal compromise by malicious or compromised user accounts.