Summary
FreeScout's legacy attachment download route skips token authentication whenever an attachment is marked with the legacy token type.
Because the file path for these attachments is predictable and the route is unauthenticated, a remote attacker can download older attachments without any valid token or user session.
FreeScout's legacy attachment download route skips token authentication whenever an attachment is marked with the legacy token type.
Because the file path for these attachments is predictable and the route is unauthenticated, a remote attacker can download older attachments without any valid token or user session.
Affected context
This vulnerability appears in FreeScout installations that still host attachments created by earlier product versions using the legacy token type.
It affects environments where:
- Legacy attachments are stored and accessible via deterministic URLs
- The download route omits token checks for
TOKEN_TYPE_LEGACY - Application-layer access control is assumed but not enforced for these resources
This vulnerability appears in FreeScout installations that still host attachments created by earlier product versions using the legacy token type.
It affects environments where:
- Legacy attachments are stored and accessible via deterministic URLs
- The download route omits token checks for
TOKEN_TYPE_LEGACY - Application-layer access control is assumed but not enforced for these resources
Exploit preconditions
- Attack surface: Public-facing FreeScout web application.
- Required access: No authentication or valid session is required.
- Trigger point: HTTP requests to the attachment download endpoint targeting legacy attachment paths.
- Why exploitation is possible: The route contains conditional logic that bypasses token validation when
token_typeis set to the legacy value, leaving those files effectively public if their paths can be derived or enumerated.
- Attack surface: Public-facing FreeScout web application.
- Required access: No authentication or valid session is required.
- Trigger point: HTTP requests to the attachment download endpoint targeting legacy attachment paths.
- Why exploitation is possible: The route contains conditional logic that bypasses token validation when
token_typeis set to the legacy value, leaving those files effectively public if their paths can be derived or enumerated.
Why this happens
The underlying issue is a broken or missing authentication check tied to specific resource types.
Authorization logic is applied inconsistently: standard attachments require a valid token or session, whereas legacy attachments are exempted via a feature flag (TOKEN_TYPE_LEGACY).
This maps to CWE-287: Improper Authentication, where an application incorrectly trusts certain requests based solely on metadata and fails to enforce authentication for all access paths to protected resources.
The underlying issue is a broken or missing authentication check tied to specific resource types.
Authorization logic is applied inconsistently: standard attachments require a valid token or session, whereas legacy attachments are exempted via a feature flag (TOKEN_TYPE_LEGACY).
This maps to CWE-287: Improper Authentication, where an application incorrectly trusts certain requests based solely on metadata and fails to enforce authentication for all access paths to protected resources.
Potential impact
- An attacker may download any legacy attachment without logging in.
- Sensitive customer correspondence or support files could be exposed.
- Confidential business documents attached to tickets may be disclosed.
- Historic data that was assumed private can be harvested at scale.
- An attacker may download any legacy attachment without logging in.
- Sensitive customer correspondence or support files could be exposed.
- Confidential business documents attached to tickets may be disclosed.
- Historic data that was assumed private can be harvested at scale.
General mitigation guidance
Mitigation typically focuses on applying consistent authentication and authorization checks across all resource types.
Recommended design patterns include:
- Ensuring every download route validates user identity and access rights regardless of legacy flags or modes.
- Treating attachment URLs as opaque and non-deterministic, avoiding guessable paths.
- Applying a central access-control layer for file retrieval rather than per-route exceptions.
- Minimizing long-lived public tokens and separating public assets from protected attachments via distinct storage and routing.
Mitigation typically focuses on applying consistent authentication and authorization checks across all resource types.
Recommended design patterns include:
- Ensuring every download route validates user identity and access rights regardless of legacy flags or modes.
- Treating attachment URLs as opaque and non-deterministic, avoiding guessable paths.
- Applying a central access-control layer for file retrieval rather than per-route exceptions.
- Minimizing long-lived public tokens and separating public assets from protected attachments via distinct storage and routing.
How teams detect issues like this
Detection efforts can focus on both configuration and code:
- Static analysis or code review to identify conditional branches that bypass authentication based on token type or flags.
- Logging and monitoring for unauthenticated requests to attachment download endpoints and unusual patterns of attachment access.
- Policy-based inspections that require every route serving protected content to call a common authentication/authorization middleware.
- Use of automated security testing tools to crawl the application and verify whether protected resources are accessible without credentials.
Detection efforts can focus on both configuration and code:
- Static analysis or code review to identify conditional branches that bypass authentication based on token type or flags.
- Logging and monitoring for unauthenticated requests to attachment download endpoints and unusual patterns of attachment access.
- Policy-based inspections that require every route serving protected content to call a common authentication/authorization middleware.
- Use of automated security testing tools to crawl the application and verify whether protected resources are accessible without credentials.
