CVE-2024-42009

An attacker sends a specially crafted email message to the victim. When this message is displayed in the Roundcube client, a desanitization error occurs in the message_body() function located in the program/actions/mail/show.php file. As a result, malicious JavaScript code embedded in the message is executed in the victim's browser in the context of the webmail application, allowing the attacker to take control of the user's session and email operations.

An attacker can read the victim's private emails and send messages on their behalf, leading to serious breach of confidentiality and integrity of correspondence. The impact may also include further attacks based on compromised credentials or information contained in the mailbox.

Roundcube Webmail should be immediately updated to version 1.5.8 or 1.6.8, in which the vendor has made security patches available. Patches are available in vendor references: https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8

Roundcube Webmail in versions up to and including 1.5.7 and versions 1.6.x up to and including 1.6.7

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.