CVE-2024-42008

An attacker sends the victim an email containing a malicious attachment with a dangerous Content-Type header. When the victim opens or displays such an attachment in the Roundcube web interface, the vulnerable rcmail_action_mail_get->run() function improperly processes the header data, resulting in execution of malicious script in the context of the user's browser. Since the vulnerability has cross-site scope (S:C in the CVSS vector), the script can affect areas outside the original application context. Only victim interaction with the sent message is required to trigger the attack.

An attacker can hijack the victim's session, read their inbox, and send emails on their behalf without their knowledge. This results in complete loss of confidentiality and integrity of the attacked user's email correspondence.

Roundcube Webmail should be updated to version 1.5.8 or 1.6.8, in which the vulnerability has been fixed. Patches and detailed information are available on the vendor's website (roundcube.net) and in the project's GitHub repository.

Roundcube Webmail in versions up to and including 1.5.7 and in versions 1.6.x up to and including 1.6.7