CVE-2024-29185 FreeScout OS Command Injection vulnerability
An attacker with the App_Key can execute arbitrary OS commands on the server via the php_path parameter, leading to full server compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-29185?
CVE-2024-29185 is a critical command injection vulnerability in freescout-helpdesk freescout, published on 22 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the php_path parameter is being executed as an OS command by the shell_exec function, without validating it. This allows an adversary to execute malicious OS commands on the server. A practical demonstration of the successful command injection attack extracted the /etc/passwd file of the server. This represented the complete compromise of the server hosting the FreeScout application. This attack requires an attacker to know the `App_Key` of the application. This limitation makes the Attack Complexity to be High. If an attacker gets hold of the `App_Key`, the attacker can compromise the Complete server on which the application is deployed. Version 1.8.128 contains a patch for this issue.
Weakness: CWE-78
Which versions are affected by CVE-2024-29185?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2024-29185?
No fix has been published for CVE-2024-29185 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-29185 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29185 exists.
Other vulnerabilities in freescout-helpdesk freescout
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
- CVE-2026-40496 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force
Sources
Also known as GHSA-7p9x-ch4c-vqj9.