CVE-2024-34698 Prototype Pollution in getQueryParam Function (URL Query Parser)
Prototype pollution in FreeScout allows attackers to inject properties into object prototypes, potentially leading to XSS or other exploits.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-34698?
CVE-2024-34698 is a medium-severity vulnerability in freescout-helpdesk freescout, published on 13 May 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/public/js/main.js` source file. The Prototype Pollution arises because the `getQueryParam` Function recursively merges an object containing user-controllable properties into an existing object (For URL Query Parameters Parsing), without first sanitizing the keys. This can allow an attacker to inject a property with a key `__proto__`, along with arbitrarily nested properties. The merge operation assigns the nested properties to the `params` object's prototype instead of the target object itself. As a result, the attacker can pollute the prototype with properties containing harmful values, which are then inherited by user-defined objects and subsequently used by the application dangerously. The vulnerability lets an attacker control properties of objects that would otherwise be inaccessible. If the application subsequently handles an attacker-controlled property in an unsafe way, this can potentially be chained with other vulnerabilities like DOM-based XSS, Open Redirection, Cookie Manipulation, Link Manipulation, HTML Injection, etc. Version 1.8.139 contains a patch for the issue.
Weakness: CWE-1321
Which versions are affected by CVE-2024-34698?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2024-34698?
No fix has been published for CVE-2024-34698 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-34698 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34698 exists.
Other vulnerabilities in freescout-helpdesk freescout
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
Sources
Also known as GHSA-rx6j-4c33-9h3r.