Overview
The Common Vulnerabilities and Exposures (CVE) system has identified a significant security vulnerability in FreeScout’s help desk software. This vulnerability, labeled CVE-2025-58163, enables potential attackers with specific knowledge of the software’s APP_KEY to execute remote code. This vulnerability is particularly severe because FreeScout’s software is widely used, and the exploit can lead to system compromise or data leakage. It underscores the necessity of regular patching and vulnerability management in maintaining secure IT environments.
Vulnerability Summary
CVE ID: CVE-2025-58163
Severity: High (8.8 CVSS score)
Attack Vector: Network
Privileges Required: Low (Authenticated Access)
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
FreeScout Help Desk Software | Up to and including 1.8.185
How the Exploit Works
The exploit leverages a deserialization of untrusted data vulnerability in the FreeScout software. The vulnerable endpoint is `/help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}`. The `customer_id` and `timestamp` parameters are processed through a decrypt function without sufficient validation. This function uses Laravel’s built-in encryption functions, which then deserialize the payload without sanitization. This lack of sanitization allows an attacker to create malicious serialized PHP objects using classes to trigger arbitrary command execution.
Conceptual Example Code
An attacker could exploit this vulnerability by crafting a malicious serialized PHP object and inserting it into either the `customer_id` or `timestamp` parameters. In practice, this might look something like the following:
GET /help/abc123/auth/O:4:"RCE":1:{s:10:"command";s:15:"rm -rf /";}//hash//timestamp HTTP/1.1
Host: target.example.comIn this conceptual example, a malicious PHP object of class “RCE” with a command property is used to delete all files in the root directory. This is a simplified example, and real-world exploits would likely be more complex and potentially more damaging.
Remember to always validate and sanitize all input to prevent such vulnerabilities. In addition, use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) for extra protection, and always keep your software updated with the latest patches. In this specific case, FreeScout has already fixed this vulnerability in version 1.8.186.
