FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass

MetasploitMetasploit exploitExploitRubyexploit_multi/http/freescout_htaccess_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-28289 in FreeScout <= 1.8.206 by sending a crafted email with a .htaccess attachment prefixed with a zero-width space (ZWSP) to bypass filename sanitization, achieving unauthenticated remote code execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit for CVE-2026-28289 and CVE-2026-27636. It sends a crafted email with a ZWSP-prefixed .htaccess attachment to achieve remote code execution on vulnerable FreeScout instances. All behavior is consistent with the stated exploit purpose: SMTP delivery, HTTP-based shell location, command execution, and cleanup. No concealed backdoor, unrelated payload, credential theft, or persistence mechanisms were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareFreeScout
Attack typesRemote Code ExecutionFile Upload Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by sending a malicious email, locating the resulting .htaccess file, and executing arbitrary code on the target. It includes all necessary logic for exploitation: email construction with ZWSP bypass, cron wait, file discovery, and payload delivery.

modules/exploits/multi/http/freescout_htaccess_rce.rb:135-153modules/exploits/multi/http/freescout_htaccess_rce.rb:171-194modules/exploits/multi/http/freescout_htaccess_rce.rb:222-234

Requirements

  • A valid mailbox email address for the target FreeScout instance.modules/exploits/multi/http/freescout_htaccess_rce.rb:40-41
  • Web-accessible attachment storage (storage:link pointing to storage/app/).modules/exploits/multi/http/freescout_htaccess_rce.rb:40-41
  • SMTP access to send the exploit email.modules/exploits/multi/http/freescout_htaccess_rce.rb:139-140

Observed behavior

  • Sends a crafted email via SMTP with a .htaccess attachment whose filename is prefixed with a zero-width space (U+200B) to bypass the sanitizeUploadedFileName() check.modules/exploits/multi/http/freescout_htaccess_rce.rb:15modules/exploits/multi/http/freescout_htaccess_rce.rb:192
  • Waits for the FreeScout cron job to fetch the email, strip the ZWSP, and store the .htaccess file in the attachment directory.modules/exploits/multi/http/freescout_htaccess_rce.rb:196-206
  • Scans the attachment storage directory structure to locate the uploaded .htaccess file by checking for a unique marker embedded in its content.modules/exploits/multi/http/freescout_htaccess_rce.rb:222-234
  • Triggers remote code execution by sending an HTTP request to the discovered .htaccess file, which is configured with SetHandler to execute as PHP.modules/exploits/multi/http/freescout_htaccess_rce.rb:17-22modules/exploits/multi/http/freescout_htaccess_rce.rb:149-153
  • Supports multiple payload types including PHP in-memory, command shells, and droppers for Linux and Windows.modules/exploits/multi/http/freescout_htaccess_rce.rb:58-99
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
ZWSP-prefixed .htaccess upload via SMTP email attachmentThe module exploits a TOCTOU vulnerability in FreeScout's filename sanitization to upload a .htaccess file that enables PHP execution.modules/exploits/multi/http/freescout_htaccess_rce.rb:15-22modules/exploits/multi/http/freescout_htaccess_rce.rb:191-192
Payload Delivery
PHP code embedded in .htaccess file with gate logic and cleanup parameterThe .htaccess file contains a PHP gate that restricts execution to POST requests and includes a self-deletion mechanism triggered by a cleanup parameter.modules/exploits/multi/http/freescout_htaccess_rce.rb:171-182
Cleanup Mechanism
Self-deletion of uploaded .htaccess file via HTTP POST with cleanup parameterThe cleanup method sends a POST request to the shell URI with a random cleanup parameter, causing the PHP code to unlink itself.modules/exploits/multi/http/freescout_htaccess_rce.rb:156-167modules/exploits/multi/http/freescout_htaccess_rce.rb:172
Network Behavior
HTTP requests to locate and trigger the uploaded shellThe module scans predictable attachment storage paths to find the uploaded .htaccess file by checking for a unique marker, then sends POST requests to execute commands.modules/exploits/multi/http/freescout_htaccess_rce.rb:222-234modules/exploits/multi/http/freescout_htaccess_rce.rb:241-248
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module was not executed; classification is based on static analysis of its intended behavior as described in the code.
  • Review is limited to the module source code and metadata. Framework mixins (e.g., Msf::Exploit::Remote::SMTPDeliver, Msf::Exploit::CmdStager) and the actual payloads (e.g., php/meterpreter/reverse_tcp) are not included in the evidence and were not analyzed.
  • Binary files were not inspected; the evidence policy flagged them as metadata-only, but no binary files were present in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2