Hackers Exploit Roundcube Webmail XSS Vulnerability to Steal Login Credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-37383 | Cross-Site Scripting in Roundcube Webmail via SVG animate attributes CVE-2024-37383 is a cross-site scripting vulnerability (CWE-79) in Roundcube Webmail caused by insufficient handling of SVG 'animate' attributes when HTML email content is rendered. An attacker triggers it by sending a crafted HTML email containing a malicious SVG animate element; when the recipient views the message in Roundcube, attacker-controlled JavaScript executes in the context of the victim's webmail session. Successful exploitation allows theft of session cookies and credentials, access to mailbox contents, sending mail as the victim, or redirection to phishing pages, and has been used in campaigns that steal credentials and email. All Roundcube Webmail deployments before 1.5.7 and 1.6.x before 1.6.7 are affected, including Roundcube packages shipped with Debian; because the attack requires only viewing a malicious email, any exposed webmail user is a potential victim. The flaw is under active exploitation: unknown threat actors have used it in phishing campaigns, it carries an EPSS of 73.3%, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-24. Do: Upgrade Roundcube to version 1.5.7 or 1.6.7 (or later) immediately; Debian users should install the updated roundcube package from their repository. Organizations subject to CISA BOD 22-01 must apply vendor mitigations or discontinue use per the KEV entry. Review webmail logs for phishing emails containing SVG animate elements and investigate for credential theft or anomalous mailbox activity. | 6.1 | 73% | KEV |
| masslikely millions of webmail users across hundreds of thousands of deployed instances, with tens of thousands of instances internet-exposed |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | libcdn.org | d password information is exfiltrated to a remote server (" libcdn[.]org ") hosted on Cloudflare. It's currently not clear who is |
Full article413 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 20, 2024Vulnerability / Email Security
Unknown threat actors have been observed attempting to exploit a now-patched security flaw in the open-source Roundcube webmail software as part of a phishing attack designed to steal user credentials.
Russian cybersecurity company Positive Technologies said it discovered last month an email that was sent to an unspecified governmental organization located in one of the Commonwealth of Independent States (CIS) countries. However, it bears noting that the message was originally sent in June 2024.
"The email appeared to be a message without text, containing only an attached document," it said in an analysis published earlier this week.
"However, the email client didn't show the attachment. The body of the email contained distinctive tags with the statement eval(atob(...)), which decode and execute JavaScript code."
The attack chain, per Positive Technologies, is an attempt to exploit CVE-2024-37383 (CVSS score: 6.1), a stored cross-site scripting (XSS) vulnerability via SVG animate attributes that allows for execution of arbitrary JavaScript in the context of the victim's web browser.
Put differently, a remote attacker could load arbitrary JavaScript code and access sensitive information simply by tricking an email recipient into opening a specially-crafted message. The issue has since been resolved in versions 1.5.7 and 1.6.7 as of May 2024.
"By inserting JavaScript code as the value for 'href,' we can execute it on the Roundcube page whenever a Roundcube client opens a malicious email," Positive Technologies noted.
The JavaScript payload, in this case, saves the empty Microsoft Word attachment ("Road map.docx"), and then proceeds to obtain messages from the mail server using the ManageSieve plugin. It also displays a login form in the HTML page displayed to the user in a bid to deceive victims into providing their Roundcube credentials.
In the final stage, the captured username and password information is exfiltrated to a remote server ("libcdn[.]org") hosted on Cloudflare.
It's currently not clear who is behind the exploitation activity, although prior flaws discovered in Roundcube have been abused by multiple hacking groups such as APT28, Winter Vivern, and TAG-70.
"While Roundcube webmail may not be the most widely used email client, it remains a target for hackers due to its prevalent use by government agencies," the company said. "Attacks on this software can result in significant damage, allowing cybercriminals to steal sensitive information."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/10/hackers-exploit-roundcube-webmail-xss.html