{"id":73423,"date":"2025-09-09T11:25:39","date_gmt":"2025-09-09T11:25:39","guid":{"rendered":""},"modified":"2025-10-06T05:35:30","modified_gmt":"2025-10-06T11:35:30","slug":"cve-2025-58163-remote-code-execution-vulnerability-in-freescout-help-desk-software","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-58163-remote-code-execution-vulnerability-in-freescout-help-desk-software\/","title":{"rendered":"CVE-2025-58163: Remote Code Execution Vulnerability in FreeScout Help Desk Software<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Common Vulnerabilities and Exposures (CVE) system has identified a significant security vulnerability in FreeScout’s help desk software. This vulnerability, labeled CVE-2025-58163, enables potential attackers with specific knowledge of the software’s APP_KEY to execute remote code. This vulnerability is particularly severe because FreeScout’s software<\/a> is widely used, and the exploit can lead to system compromise or data leakage. It underscores the necessity of regular patching and vulnerability management<\/a> in maintaining secure IT environments.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-58163
\nSeverity: High (8.8 CVSS score)
\nAttack Vector: Network
\nPrivileges Required: Low (Authenticated Access)
\nUser Interaction: None
\nImpact: System compromise<\/a> or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

FreeScout Help Desk Software | Up to and including 1.8.185<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit leverages a deserialization of untrusted data vulnerability<\/a> in the FreeScout software. The vulnerable endpoint<\/a> is `\/help\/{mailbox_id}\/auth\/{customer_id}\/{hash}\/{timestamp}`. The `customer_id` and `timestamp` parameters are processed through a decrypt function without sufficient validation. This function uses Laravel’s built-in encryption functions, which then deserialize the payload without sanitization. This lack of sanitization allows an attacker to create malicious serialized PHP objects<\/a> using classes to trigger arbitrary command execution.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An attacker could exploit this vulnerability by crafting a malicious serialized PHP<\/a> object and inserting it into either the `customer_id` or `timestamp` parameters. In practice, this might look something like the following:<\/p>\n

GET \/help\/abc123\/auth\/O:4:\"RCE\":1:{s:10:\"command\";s:15:\"rm -rf \/\";}\/\/hash\/\/timestamp HTTP\/1.1\nHost: target.example.com<\/code><\/pre>\n
In this conceptual example, a malicious PHP object of class “RCE” with a command property is used to delete all files<\/a> in the root directory. This is a simplified example, and real-world exploits would likely be more complex and potentially more damaging.
\nRemember to always validate and sanitize all input to prevent such vulnerabilities<\/a>. In addition, use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) for extra protection, and always keep your software updated with the latest patches. In this specific case, FreeScout has already fixed this vulnerability in version<\/a> 1.8.186.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Common Vulnerabilities and Exposures (CVE) system has identified a significant security vulnerability in FreeScout’s help desk software. This vulnerability, labeled CVE-2025-58163, enables potential attackers with specific knowledge of the software’s APP_KEY to execute remote code. This vulnerability is particularly severe because FreeScout’s software is widely used, and the exploit can lead to system […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-73423","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t