CISA adds Roundcube Webmail Persistent XSS bug to its Known Exploited Vulnerabilities catalog

Roundcube Webmail contains a cross-site scripting (XSS) flaw (CWE-79) in the link-reference handling of rcube_string_replacer.php, where the linkref_addindex function mishandles JavaScript embedded in a link element of a plain-text email. An attacker triggers the flaw simply by sending a crafted plain-text message to a victim; when the message is processed/displayed in the Roundcube interface, the embedded script executes in the context of the victim's webmail session. Successful exploitation can lead to session hijacking, theft of webmail cookies or credentials, and arbitrary actions in the victim's mailbox. Any deployment of Roundcube Webmail is affected, which includes self-hosted instances and webmail offered by hosting providers, ISPs, and universities. Although no public proof-of-concept is known, CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 2023-06-22, confirming exploitation in the wild; ransomware association is unknown, and no CVSS score is yet available, though EPSS puts 30-day exploitation probability at 32.7% (98th percentile).

Do: Apply the vendor's updated Roundcube release per CISA's required action (updates per vendor instructions); since no specific fixed versions appear in this data, install the latest patched release of your deployed 1.x branch and verify with the vendor advisory. Check webmail servers for processing of plain-text messages with link-reference elements and review logs for anomalous webmail sessions; treat KEV-listed status as evidence of active exploitation and prioritize internet-exposed Roundcube instances.

Roundcube Webmail versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 contain a persistent cross-site scripting (XSS) flaw (CWE-79) caused by how program/lib/Roundcube/rcube_string_replacer.php converts plain text into clickable links. An attacker sends a text/plain email containing crafted links; when the recipient views the message, the crafted link text is turned into HTML that runs attacker-controlled script, which persists and executes in the victim's webmail session. Successful exploitation lets the attacker execute JavaScript with the victim's session, enabling mailbox access, theft of session credentials, and actions performed as the user (CVSS 6.1, scope-changed with limited confidentiality and integrity impact). Anyone running an affected Roundcube instance is exposed, including the roundcube package shipped with Debian Linux. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-02-12, and EPSS assigns a 58.5% probability of exploitation within 30 days (99th percentile).

Do: Upgrade Roundcube to 1.4.14, 1.5.4, or 1.6.3 (or later, per branch), or install the updated roundcube package on Debian. Because the bug is in CISA's KEV catalog, U.S. federal agencies must apply the vendor fix by the catalog due date, and other defenders should prioritize patching internet-facing webmail servers. Review webmail access logs for suspicious message views or account activity, and consider forcing session re-authentication for accounts that opened crafted plain-text messages.