CVE-2024-34697: Freescout Email HTML Injection Vulnerability

CVE-2024-34697 Overview

CVE-2024-34697 is a stored HTML Injection vulnerability in the Email Receival Module of FreeScout, a self-hosted help desk and shared mailbox application. Unauthenticated attackers can inject malicious HTML content into emails sent to the application's mailbox. The application fails to sanitize HTML content in incoming emails, allowing attackers to embed markup that renders in the context of the application's domain. This flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and [CWE-74] (Improper Neutralization of Special Elements in Output). FreeScout version 1.8.139 introduces strict input validation and sanitization to remediate the issue.

Critical Impact
Unauthenticated attackers can send crafted emails that inject HTML into agent-facing views, enabling form hijacking, application defacement, and data exfiltration through CSS injection.

Affected Products

FreeScout help desk application
Versions prior to 1.8.139
Deployments exposing the Email Receival Module to inbound email

Discovery Timeline

2024-05-14 - CVE-2024-34697 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34697

Vulnerability Analysis

The vulnerability resides in how FreeScout processes incoming email bodies before rendering them in the agent interface. When an email arrives, the Email Receival Module parses HTML content and stores it as part of a conversation thread. The stored content is subsequently rendered when agents view or edit threads, executing the injected markup in the browser under the application's origin. Because email is an unauthenticated input channel, any external sender can trigger the injection by delivering a crafted message to a monitored mailbox. Attackers can leverage this to overlay fake login forms, deface the interface, or exfiltrate data using CSS-based selector attacks that transmit content through background image requests.

Root Cause

The root cause is missing sanitization of HTML content received through the email ingestion pipeline. Dangerous tags and attributes were not stripped before storage or rendering. The patch introduces a call to \Helper::stripDangerousTags() against the thread body prior to view rendering, ensuring that unsafe elements are removed from the persisted content path rather than only from the final HTML fragment.

Attack Vector

Exploitation requires no authentication and no privileges on the FreeScout instance. The attacker sends an email containing malicious HTML to any address monitored by FreeScout. When an agent opens or edits the resulting conversation thread, the injected HTML executes within the application's domain context. User interaction from the agent is required to trigger rendering.

php

// Patch excerpt: app/Http/Controllers/ConversationsController.php
                }

                if (!$response['msg']) {
+                    $thread->body = \Helper::stripDangerousTags($thread->body);
+
                    $data = [
                        'thread' => $thread
                    ];
                    $response['html'] = \View::make('conversations/partials/edit_thread')->with($data)->render();
-                    $response['html'] = \Helper::stripDangerousTags($response['html']);

                    $response['status'] = 'success';
                }

Source: FreeScout Security Patch Commit 99a4b4b. The fix sanitizes the thread body itself before it is passed to the view, rather than sanitizing only the rendered HTML fragment.

Detection Methods for CVE-2024-34697

Indicators of Compromise

Inbound emails containing <form>, <iframe>, <style>, <script>, or <meta> elements in the HTML body of ticket submissions
Conversation threads whose stored body contains external resource references such as background image URLs pointing to attacker-controlled domains
Unexpected outbound HTTP requests originating from agent browsers when viewing ticket threads

Detection Strategies

Inspect the FreeScout database threads table for stored HTML tags that should not appear in normal customer email content
Correlate inbound email logs with agent session activity to identify threads that trigger anomalous browser network requests
Review web server logs for referer headers pointing back to FreeScout URLs coupled with requests to unknown external hosts

Monitoring Recommendations

Enable content security policy reporting on the FreeScout web interface to capture blocked inline scripts and framed content
Alert on inbound mail flagged by mail security gateways for suspicious HTML constructs before delivery to the help desk mailbox
Track FreeScout version strings across deployments to confirm all instances are running 1.8.139 or later

How to Mitigate CVE-2024-34697

Immediate Actions Required

Upgrade FreeScout to version 1.8.139 or later, which enforces sanitization on incoming email HTML
Audit existing conversation threads for stored malicious HTML introduced prior to patching and purge affected records
Restrict the mailboxes monitored by FreeScout to reduce exposure to arbitrary external senders where feasible

Patch Information

The fix is delivered in FreeScout 1.8.139 and documented in GitHub Security Advisory GHSA-985r-6qfc-hg8m. The corresponding code change is available in FreeScout Commit 99a4b4b, which applies \Helper::stripDangerousTags() to the thread body before rendering.

Workarounds

Deploy an email security gateway rule that strips or quarantines HTML with <script>, <style>, <iframe>, and <form> tags before delivery to FreeScout
Enforce a strict Content Security Policy on the FreeScout web interface to block inline scripts, remote form actions, and external stylesheet loads
Train agents to open suspicious tickets in an isolated browser profile until the upgrade to 1.8.139 is completed

bash

# Verify installed FreeScout version and upgrade via the standard release process
php artisan freescout:info | grep -i version
git fetch --tags && git checkout 1.8.139
php artisan freescout:after-app-update