Roundcube XSS flaw exploited to steal credentials, email (CVE-2024-37383)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-37383 | Cross-Site Scripting in Roundcube Webmail via SVG animate attributes CVE-2024-37383 is a cross-site scripting vulnerability (CWE-79) in Roundcube Webmail caused by insufficient handling of SVG 'animate' attributes when HTML email content is rendered. An attacker triggers it by sending a crafted HTML email containing a malicious SVG animate element; when the recipient views the message in Roundcube, attacker-controlled JavaScript executes in the context of the victim's webmail session. Successful exploitation allows theft of session cookies and credentials, access to mailbox contents, sending mail as the victim, or redirection to phishing pages, and has been used in campaigns that steal credentials and email. All Roundcube Webmail deployments before 1.5.7 and 1.6.x before 1.6.7 are affected, including Roundcube packages shipped with Debian; because the attack requires only viewing a malicious email, any exposed webmail user is a potential victim. The flaw is under active exploitation: unknown threat actors have used it in phishing campaigns, it carries an EPSS of 73.3%, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-24. Do: Upgrade Roundcube to version 1.5.7 or 1.6.7 (or later) immediately; Debian users should install the updated roundcube package from their repository. Organizations subject to CISA BOD 22-01 must apply vendor mitigations or discontinue use per the KEV entry. Review webmail logs for phishing emails containing SVG animate elements and investigate for credential theft or anomalous mailbox activity. | 6.1 | 73% | KEV |
| masslikely millions of webmail users across hundreds of thousands of deployed instances, with tens of thousands of instances internet-exposed |
Full article383 words · extracted from helpnetsecurity.com · click to collapse
Attackers have exploited an XSS vulnerability (CVE-2024-37383) in the Roundcube Webmail client to target a governmental organization of a CIS country, Positive Technologies (PT) analysts have discovered.
The vulnerability was patched in May 2024, in Roundcube Webmail versions 1.5.7 and 1.6.7. The email carrying the exploit was sent in June 2024.
About CVE-2024-37383
Roundcube is an open-source, browser-based IMAP client with a user interface that makes it look like a standalone application.
CVE-2024-37383 is a cross-site scripting vulnerability that can be triggered via SVG animate attributes. Cross-site scripting allows attackers to inject malicious code into trusted websites, which is executed once the website is loaded.
In this case, the email was crafted to show no text, just an attached document, but simply opening the email was enough to execute malicious JavaScript code on the user’s page.
The email carrying the exploit (Source: Positive Technologies)
The email body actually contains hidden JavaScript code, which downloads Road map.doc to serve as a decoy, while in the background it:
- Tries to grab messages from the mail server using the ManageSieve plugin
- Adds an authorization form to the HTML page displayed to the user, with the hope that the target’s login and password for the Roundcube client will either be autofilled or entered by the target. If that happens, the credentials are exfiltrated to a remote server controlled by the attackers.
This phishing campaign cannot be linked to known actors at this time, the researchers shared.
The importance of timely patching
XSS vulnerabilities in Roundcube Webmail are discovered (and patched) often.
They’ve also been previously exploited by state-sponsored threat actors to target governmental entities in Ukraine and across Europe, sometimes as zero-days (i.e., vulnerabilities only known to attackers, with no existing fix).
“While Roundcube Webmail may not be the most widely used email client, it remains a target for hackers due to its prevalent use by government agencies. Attacks on this software can result in significant damage, allowing cybercriminals to steal sensitive information,” PT researchers noted, and highlighted the importance of timely updating of software.
Roundcube Webmain is actively developed and fixes for privately reported and zero-day vulnerabilities are pushed out regularly.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/10/22/cve-2024-37383-exploited/