Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-41637 | RaspAP before 3.1.5 allows an attacker to escalate privileges: RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password. NVD description · AI analysis pending | 8.3 | <1% | — | — | ||
| CVE-2024-42009 +1 in the same advisory: …42008 | Cross-Site Scripting in Roundcube Webmail Lets Attackers Steal Emails CVE-2024-42009 is a cross-site scripting (CWE-79) vulnerability in Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7, caused by a desanitization issue in message_body() in program/actions/mail/show.php. An attacker sends a specially crafted email, and when the victim opens it in the Roundcube interface, injected script runs in the context of the victim's webmail session (no privileges are required, but user interaction is needed, per the CVSS UI:R vector). Successful exploitation lets the attacker steal the victim's emails and send messages as the victim, and related reporting notes that, chained with the companion flaw CVE-2024-42008, attackers can compromise email accounts and passwords. Any organization or provider self-hosting an affected Roundcube version is exposed, including universities, hosting providers, enterprises, and government mail systems. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-06-09, EPSS is 82.9% (100th percentile), and recent headlines describe suspected China-aligned espionage activity using Roundcube exploit chains against universities. Do: Upgrade Roundcube to a point release newer than 1.6.7 on the 1.6.x line or newer than 1.5.7 on the 1.5.x line (the latest vendor release of each branch), per vendor instructions; organizations under BOD 22-01 must apply the required mitigations by the KEV due date or discontinue use. Also patch the companion issue CVE-2024-42008 to prevent chained account compromise. Review webmail access logs for suspicious requests to the mail show handler, check sent-mail folders for messages sent unexpectedly as users, and rotate sessions/credentials for potentially targeted accounts. | 9.3 | 83% | KEV |
| massroughly millions of users across tens of thousands of self-hosted instances (public scans show tens of thousands of internet-exposed Roundcube servers) | |
| CVE-2024-42010 | mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail message mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information. NVD description · AI analysis pending | 7.5 | 53% | — | — |
Full article465 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 07, 2024Email Security / Vulnerability
Cybersecurity researchers have disclosed details of security flaws in the Roundcube webmail software that could be exploited to execute malicious JavaScript in a victim's web browser and steal sensitive information from their account under specific circumstances.
"When a victim views a malicious email in Roundcube sent by an attacker, the attacker can execute arbitrary JavaScript in the victim's browser," cybersecurity company Sonar said in an analysis published this week.
"Attackers can abuse the vulnerability to steal emails, contacts, and the victim's email password as well as send emails from the victim's account."
Following responsible disclosure on June 18, 2024, the three vulnerabilities have been addressed in Roundcube versions 1.6.8 and 1.5.8 released on August 4, 2024.
The list of vulnerabilities is as follows -
- CVE-2024-42008 - A cross-site scripting flaw via a malicious email attachment served with a dangerous Content-Type header
- CVE-2024-42009 - A cross-site scripting flaw that arises from post-processing of sanitized HTML content
- CVE-2024-42010 - An information disclosure flaw that stems from insufficient CSS filtering
Successful exploitation of the aforementioned flaws could allow unauthenticated attackers to steal emails and contacts, as well as send emails from a victim's account, but after viewing a specially crafted email in Roundcube.
"Attackers can gain a persistent foothold in the victim's browser across restarts, allowing them to exfiltrate emails continuously or steal the victim's password the next time it is entered," security researcher Oskar Zeino-Mahmalat said.
"For a successful attack, no user interaction beyond viewing the attacker's email is required to exploit the critical XSS vulnerability (CVE-2024-42009). For CVE-2024-42008, a single click by the victim is needed for the exploit to work, but the attacker can make this interaction unobvious for the user."
Additional technical details about the issues have been withheld to give time for users to update to the latest version, and in light of the fact that flaws in the webmail software have been repeatedly exploited by nation-state actors like APT28, Winter Vivern, and TAG-70.
The findings come as details have emerged about a maximum-severity local privilege escalation flaw in the RaspAP open-source project (CVE-2024-41637, CVSS score: 10.0) that allows an attacker to elevate to root and execute several critical commands. The vulnerability has been addressed in version 3.1.5.
"The www-data user has write access to the restapi.service file and also possesses sudo privileges to execute several critical commands without a password," a security researcher who goes by the online alias 0xZon1 said. "This combination of permissions allows an attacker to modify the service to execute arbitrary code with root privileges, escalating their access from www-data to root."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/08/roundcube-webmail-flaws-allow-hackers.html