Freshdesk (official) Security & Risk Analysis

The "freshdesk-support" plugin v2.4.1 exhibits a mixed security posture. On the positive side, it demonstrates good practices with a high percentage of SQL queries using prepared statements and a significant portion of outputs being properly escaped. The presence of nonce and capability checks also indicates an awareness of security principles. However, critical concerns arise from the static analysis, particularly the presence of one AJAX handler without authentication checks, which represents a direct attack vector. Furthermore, the taint analysis reveals three flows with unsanitized paths, suggesting potential vulnerabilities for data manipulation or injection, although these are not categorized as critical or high in severity.

The plugin's vulnerability history, with three known CVEs including one high and two medium severity, is a significant red flag. The common vulnerability types, Open Redirect and CSRF, are often associated with insecure handling of user input and lack of proper authentication/authorization. The fact that the last vulnerability was as recent as April 2024 suggests ongoing security challenges or a pattern of introducing vulnerabilities. While there are currently no unpatched CVEs, the historical pattern raises concerns about the long-term security maintenance of the plugin. Overall, the plugin has strengths in its implementation of secure coding practices like prepared statements, but the identified unauthenticated entry points and historical vulnerability trends necessitate careful consideration and prompt patching when new issues are discovered.