FreeScout Mailbox OAuth Disconnect CSRF Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in FreeScout versions prior to 1.8.215, specifically within the mailbox OAuth disconnect feature. The disconnect action is performed via a GET request, which removes stored OAuth metadata and redirects the user. Because this action does not require a CSRF token, it can be exploited cross-site against an admin user of the mailbox.

Impact

Exploitation of this vulnerability allows for the unauthorized disconnection of OAuth credentials from a mailbox, disrupting email fetching and delivery for the affected account.

Reproduction

To reproduce this vulnerability, log into FreeScout as an admin and navigate to a mailbox with active OAuth metadata. Then, send a GET request to the OAuth disconnect endpoint for that mailbox, provider, and direction (in or out). This can be done manually or by crafting a CSRF payload, such as an image tag, that targets the disconnect action.

Remediation

Users can update to FreeScout version 1.8.215 or later, where this vulnerability has been fixed.