CVE-2020-35730
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2020-35730 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The flaw resides in the linkref_addindex function within rcube_string_replacer.php, which improperly handles JavaScript embedded in link reference elements of plain text email messages. An attacker can craft a malicious email that, when viewed by a recipient, executes arbitrary JavaScript in the victim's browser session, potentially stealing session cookies, redirecting users, or performing actions on their behalf. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and carries an EPSS score of 64.8% (98th percentile), indicating a high probability of active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.2.13; >= 1.3.0, < 1.3.16; >= 1.4, < 1.4.10 |
| fedoraproject | fedora | 32; 33 |
| debian | debian linux | 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491(Issue Tracking, Mailing List)
- https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10(Patch)
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.13(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.16(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.10(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/(Mailing List, Release Notes)
- https://roundcube.net/download/(Product)
- https://www.alexbirnberg.com/roundcube-xss.html(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
In Roundcube Webmail, the linkref_addindex function in rcube_string_replacer.php fails to properly sanitize JavaScript content embedded within link reference elements in plain text emails. This allows an attacker to inject malicious scripts that execute in the context of the victim's browser session when viewing the crafted email.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation
Impact Analysis
CVE-2020-35730 is a remotely exploitable cross-site scripting vulnerability that requires no authentication to trigger, though user interaction is necessary as the victim must view the malicious email. With a CVSS score of 6.1 (Medium) and a scope rating of Changed, successful exploitation can affect resources beyond the vulnerable Roundcube Webmail component itself. Confidentiality (Low): An attacker can steal session tokens, cookies, and other sensitive information accessible within the user's browser context. Integrity (Low): The attacker can modify displayed content, forge email actions, or redirect the user to phishing pages. Availability (None): This vulnerability does not directly impact system availability. The EPSS score of 64.8% places this vulnerability in the 98th percentile, reflecting a strong likelihood of exploitation, and its presence in the CISA KEV catalog confirms that threat actors have actively targeted Roundcube Webmail users through this XSS flaw.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-35730 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of July 13, 2023. The EPSS score of 64.8% (98th percentile) further underscores the high probability of exploitation activity targeting Roundcube Webmail installations. While no dedicated public exploit code with an "Exploit" tag is listed in the NVD references, the Debian bug tracker and vendor patch commits provide sufficient technical detail for attackers to reconstruct a working exploit. Organizations running unpatched versions of Roundcube Webmail should treat this vulnerability as actively exploited and prioritize immediate remediation.
Remediation
- Apply vendor patches immediately as directed by CISA: upgrade Roundcube Webmail to version 1.2.13 or later (for 1.2.x), 1.3.16 or later (for 1.3.x), or 1.4.10 or later (for 1.4.x). Official releases are available at the Roundcube download page.
- Review the specific patch in the 1.4.9 to 1.4.10 comparison to understand the fix applied to rcube_string_replacer.php and verify it is present in your deployment.
- Implement Content Security Policy (CSP) headers on the Roundcube Webmail server to restrict inline script execution and mitigate the impact of any XSS vulnerabilities, including setting strict script-src directives.
- Monitor web server and application logs for suspicious activity such as unusual JavaScript payloads in email content, unexpected session activity, or indicators of session hijacking.
- Consider deploying a Web Application Firewall (WAF) with rules to detect and block common XSS payloads in HTTP requests and email content processed by the webmail interface.
Technical Details
The vulnerability in CVE-2020-35730 originates in the linkref_addindex function of rcube_string_replacer.php, which processes link reference elements in plain text email messages. When Roundcube Webmail parses a plain text email containing specially crafted link references, the function fails to properly sanitize or encode JavaScript protocol handlers and other executable content within the reference URLs. Attack vector (Network): The attacker sends a malicious email to the target user; no direct access to the server is required. Attack complexity (Low): The exploit requires only a well-crafted plain text email with JavaScript in a link reference element. Scope (Changed): Because the injected script executes in the victim's browser session within the Roundcube web application context, it can access resources beyond the vulnerable email parsing component, including session cookies, DOM elements, and potentially other browser-accessible data. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects that while user interaction (opening the email) is required, no privileges are needed by the attacker to deliver the payload.
Frequently Asked Questions
Is CVE-2020-35730 being actively exploited?
Yes, CVE-2020-35730 is confirmed to be actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. The EPSS score of 64.8% (98th percentile) further indicates a high likelihood of ongoing exploitation.
What products are affected by CVE-2020-35730?
CVE-2020-35730 affects Roundcube Webmail versions before 1.2.13, versions 1.3.x before 1.3.16, and versions 1.4.x before 1.4.10. Additionally, Fedora and Debian Linux distributions that package Roundcube Webmail are affected if running vulnerable versions.
How do I fix CVE-2020-35730?
Upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or later depending on your release branch. Downloads are available from the official Roundcube website. Additionally, implement Content Security Policy headers and consider deploying a WAF to provide defense-in-depth against XSS attacks.
How severe is CVE-2020-35730?
CVE-2020-35730 has a CVSS score of 6.1 (Medium severity) under CVSS v3.1. However, its severity in practice is elevated by confirmed active exploitation and an EPSS score in the 98th percentile, indicating that the vast majority of vulnerabilities are less likely to be exploited than this one.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.