This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A TOCTOU flaw in `sanitizeUploadedFileName` allows malicious file uploads. π₯ **Consequences**: Remote Code Execution (RCE) via `.htaccess` files.β¦
π‘οΈ **Root Cause**: **CWE-434** (Unrestricted Upload of File with Dangerous Type). The sanitization logic has a **Time-of-Check to Time-of-Use (TOCTOU)** race condition, failing to block dangerous extensions effectively.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: **FreeScout** (PHP/Laravel Help Desk). Versions **1.8.206 and earlier**. Vendor: `freescout-help-desk`.
Q4What can hackers do? (Privileges/Data)
π **Attacker Capabilities**: Authenticated users with **file upload permissions** can upload `.htaccess` files. This leads to **RCE**, granting full control over the server environment.
Q5Is exploitation threshold high? (Auth/Config)
β οΈ **Threshold**: **Low**. CVSS indicates **No Privileges Required** for network access, but the description notes 'authenticated users'.β¦
π **Public Exploit**: **No PoC** currently listed in the data. However, the vulnerability type (TOCTOU + Upload) is well-understood. Wild exploitation risk increases as details become public.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for **FreeScout** instances. Check if version is **β€ 1.8.206**. Verify if file upload features are enabled and if `.htaccess` files can be uploaded via the web interface.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed**: **Yes**. Patch available via GitHub Advisory **GHSA-5gpc-65p8-ffwp** and commit **f7bc16c56a6b13c06da52ad51fd666546b40818f**. Update immediately.
Q9What if no patch? (Workaround)
π **No Patch Workaround**: **Disable file uploads** entirely if not needed. Implement strict **WAF rules** to block `.htaccess` uploads. Restrict upload permissions to trusted admins only.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **CRITICAL**. CVSS Score is **High** (likely 9.0+ based on vector). RCE via upload is a high-impact vector. **Patch immediately** upon availability.