Nation State Hackers Exploiting Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-35730 | Cross-Site Scripting in Roundcube Webmail Plain-Text Email Link Handling Roundcube Webmail contains a cross-site scripting (XSS) flaw (CWE-79) in the link-reference handling of rcube_string_replacer.php, where the linkref_addindex function mishandles JavaScript embedded in a link element of a plain-text email. An attacker triggers the flaw simply by sending a crafted plain-text message to a victim; when the message is processed/displayed in the Roundcube interface, the embedded script executes in the context of the victim's webmail session. Successful exploitation can lead to session hijacking, theft of webmail cookies or credentials, and arbitrary actions in the victim's mailbox. Any deployment of Roundcube Webmail is affected, which includes self-hosted instances and webmail offered by hosting providers, ISPs, and universities. Although no public proof-of-concept is known, CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 2023-06-22, confirming exploitation in the wild; ransomware association is unknown, and no CVSS score is yet available, though EPSS puts 30-day exploitation probability at 32.7% (98th percentile). Do: Apply the vendor's updated Roundcube release per CISA's required action (updates per vendor instructions); since no specific fixed versions appear in this data, install the latest patched release of your deployed 1.x branch and verify with the vendor advisory. Check webmail servers for processing of plain-text messages with link-reference elements and review logs for anomalous webmail sessions; treat KEV-listed status as evidence of active exploitation and prioritize internet-exposed Roundcube instances. | 6.1 | 33% | KEV |
| masslikely >1M users across tens of thousands of exposed instances (Roundcube is bundled as webmail in cPanel/Plesk and by many ISPs) | |
| CVE-2023-5631 | Stored XSS in Roundcube Webmail exploited in the wild (CVE-2023-5631) CVE-2023-5631 is a stored cross-site scripting (XSS) flaw in Roundcube Webmail caused by insufficient sanitization of SVG content embedded in HTML email by program/lib/Roundcube/rcube_washtml.php. A remote attacker triggers it by sending a crafted HTML email containing a malicious SVG document; when the recipient views the message, arbitrary JavaScript is loaded in their browser session. This lets the attacker act as the victim within the webmail session — for example reading mail or capturing session data — and it has been used in targeted espionage rather than commodity attacks. Anyone running Roundcube before 1.4.15, 1.5.x before 1.5.5, or 1.6.x before 1.6.4 is affected, including Roundcube packages shipped by Debian and Fedora. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-26, the Winter Vivern espionage group is reported to have exploited it as a zero-day against government entities, and EPSS puts the 30-day exploitation probability at ~76% (99th percentile). Do: Upgrade to Roundcube 1.6.4, or 1.5.5 on the 1.5.x branch and 1.4.15 on the 1.4.x branch; apply the corresponding patched roundcube packages for Debian or Fedora. Per the CISA KEV required action, apply vendor mitigations or discontinue use if patching is unavailable. Hunt for compromise by reviewing webmail logs and stored messages for crafted SVG/HTML emails sent around the exploitation window, and review sessions for signs of hijacking. | 5.4 | 76% | KEV PoC |
| largetens of thousands of internet-exposed Roundcube servers; plausibly 100k+ end users, unknown precisely |
Full article371 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 25, 2023Threat Intelligence / Vulnerability
The threat actor known as Winter Vivern has been observed exploiting a zero-day flaw in Roundcube webmail software on October 11, 2023, to harvest email messages from victims' accounts.
"Winter Vivern has stepped up its operations by using a zero-day vulnerability in Roundcube," ESET security researcher Matthieu Faou said in a new report published today. Previously, it was using known vulnerabilities in Roundcube and Zimbra, for which proofs-of-concept are available online."
Winter Vivern, also known as TA473 and UAC-0114, is an adversarial collective whose objectives align with that of Belarus and Russia. Over the past few months, it has been attributed to attacks against Ukraine and Poland, as well as government entities across Europe and India.
The group is also assessed to have exploited another flaw Roundcube as recently as August and September (CVE-2020-35730), making it the second nation-state group after APT28 to target the open-source webmail software.
The new security vulnerability in question is CVE-2023-5631 (CVSS score: 5.4), a stored cross-site scripting flaw that could allow a remote attacker to load arbitrary JavaScript code. A fix was released on October 16, 2023.
Attack chains mounted by the group commence with a phishing message that incorporates a Base64-encoded payload in the HTML source code that, in turn, decodes to a JavaScript injection from a remote server by weaponizing the XSS flaw.
"In summary, by sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user's browser window," Faou explained. "No manual interaction other than viewing the message in a web browser is required."
The second-stage JavaScript (checkupdate.js) is a loader that facilitates the execution of a final JavaScript payload that allows the threat actor to exfiltrate email messages to a command-and-control (C2) server.
"Despite the low sophistication of the group's toolset, it is a threat to governments in Europe because of its persistence, very regular running of phishing campaigns, and because a significant number of internet-facing applications are not regularly updated although they are known to contain vulnerabilities," Faou said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/10/nation-state-hackers-exploiting-zero.html