A stored cross-site scripting vulnerability in FreeScout allows authenticated users with specific mailbox permissions to inject malicious scripts, potentially leading to unauthorized actions.

The application utilizes an incomplete blocklist in the Helper::stripDangerousTags() function, which fails to neutralize event handler attributes such as onerror and onload. Any authenticated user possessing the ACCESS_PERM_SIGNATURE permission can inject arbitrary JavaScript that executes automatically upon rendering within the application interface.

The exploitation of this vulnerability allows an attacker to execute arbitrary code within the context of other users, including administrators. This can lead to session hijacking, unauthorized data access, or the performance of actions on behalf of the victim, effectively compromising the integrity of the help desk platform. With a CVSS score of 8.5, this flaw represents a high-severity risk that could facilitate lateral movement within the organization.

Immediate Action: Update the FreeScout installation to version 1.8.213 or later to apply the necessary sanitization logic.

Proactive Monitoring: Review application logs for unusual activity related to mailbox signature updates or unexpected modifications to user profiles and settings.

Compensating Controls: Implement a Web Application Firewall with rules configured to detect and block suspicious HTML event handlers in user-supplied input fields.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for script execution with the privileges of other users, including those with elevated access, organizations should prioritize patching this vulnerability. Apply the update to version 1.8.213 immediately to ensure that input sanitization is correctly enforced and to prevent the unauthorized execution of malicious scripts within your help desk environment.