CVE-2023-43770
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2023-43770 is a Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3, as well as Debian Linux systems running affected Roundcube packages. The vulnerability exists in the rcube_string_replacer.php component, which fails to properly sanitize crafted links embedded in plain-text email messages, enabling an attacker to inject and execute malicious scripts in the victim's browser. Exploitation of CVE-2023-43770 requires a user to view a specially crafted email, but no authentication or special privileges are required on the attacker's side. CISA has confirmed active exploitation and added this vulnerability to the Known Exploited Vulnerabilities catalog, and with an EPSS score of 76.4% (98.9th percentile), this XSS vulnerability is being actively targeted against Roundcube deployments worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.4.14; >= 1.5.0, < 1.5.4; >= 1.6.0, < 1.6.3 |
| debian | debian linux | 10.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b(Patch)
- https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html(Mailing List)
- https://roundcube.net/news/2023/09/15/security-update-1.6.3-released(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43770(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 describes a weakness where a web application fails to properly neutralize user-controlled input before it is rendered in a web page, allowing attackers to inject executable scripts into pages viewed by other users. In CVE-2023-43770, Roundcube Webmail's link-processing logic in rcube_string_replacer.php does not adequately sanitize crafted hyperlinks in plain-text email bodies, causing malicious script payloads to execute in the victim's browser session when the email is viewed.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation
Impact Analysis
CVE-2023-43770 carries a CVSS score of 6.1 (MEDIUM) but its real-world risk is elevated by its network-based attack vector, low attack complexity, and changed scope — meaning the vulnerability can affect resources beyond the Roundcube application itself, such as the victim's browser session or other web origins. Confidentiality (Low): An attacker can read session cookies, authentication tokens, or other browser-accessible data, potentially enabling session hijacking against Roundcube users. Integrity (Low): Injected scripts can modify the Roundcube interface or redirect users to attacker-controlled pages, facilitating phishing or credential theft. Availability (None): No direct availability impact is indicated. The Scope Changed metric (S:C) is particularly significant — it means the XSS payload can impact resources or origins beyond the vulnerable Roundcube component itself, amplifying the potential attack surface. With a 76.4% EPSS score (98.9th percentile), active exploitation is highly likely and confirmed by CISA.
Exploit Maturity
CVE-2023-43770 is confirmed as actively exploited in the wild per CISA's Known Exploited Vulnerabilities catalog, with a remediation deadline of March 4, 2024. No ransomware association has been confirmed for this vulnerability. The EPSS score of 76.4% (98.9th percentile) reflects that this XSS vulnerability is among the most actively exploited in its class, with real-world attackers targeting Roundcube installations — a popular open-source webmail solution widely used by organizations and government entities. A patch commit is publicly available at https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b, which serves as a reference for the fix and provides insight into the vulnerability mechanism, likely lowering the bar for exploit development.
Remediation
- Upgrade Roundcube Webmail immediately to version 1.4.14 or later, 1.5.4 or later, or 1.6.3 or later, as announced in the Roundcube security advisory at https://roundcube.net/news/2023/09/15/security-update-1.6.3-released.
- Debian Linux users should apply the security update published in the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html.
- As an interim measure, implement a Content Security Policy (CSP) header on the Roundcube deployment to restrict script execution sources and reduce XSS impact.
- Enable and review Roundcube access logs for unusual activity, particularly script injection attempts or anomalous session behavior that could indicate exploitation.
- For long-term hardening, validate all user-supplied input and link-processing logic within Roundcube plugins and customizations, and ensure output encoding is applied consistently across HTML rendering code paths.
Technical Details
CVE-2023-43770 exploits an input neutralization failure (CWE-79) in Roundcube's rcube_string_replacer.php, the component responsible for processing and rendering links found in plain-text email bodies. When a user opens an email containing a crafted hyperlink, the link-rendering logic fails to properly encode or strip malicious content, resulting in script injection into the rendered HTML page within the victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects that the attack originates from the network with no special conditions, requires no attacker authentication, and only needs user interaction in the form of viewing the email. The changed scope (S:C) indicates that the XSS payload can cross trust boundaries within the browser, potentially allowing access to session data or cross-origin interactions beyond the Roundcube application. CWE-79 vulnerabilities in webmail clients are especially impactful because emails are an inherently untrusted, attacker-controlled input channel delivered directly to the vulnerable interface.
Frequently Asked Questions
Is CVE-2023-43770 being actively exploited?
Yes. CISA has confirmed CVE-2023-43770 as actively exploited in the wild and included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of March 4, 2024. The vulnerability's EPSS score of 76.4% (98.9th percentile) confirms it is among the most actively targeted webmail vulnerabilities currently tracked.
What products are affected by CVE-2023-43770?
CVE-2023-43770 affects Roundcube Webmail versions before 1.4.14, versions 1.5.x before 1.5.4, and versions 1.6.x before 1.6.3. Debian Linux systems running affected Roundcube packages are also impacted. Organizations self-hosting any of these Roundcube versions should treat this as urgent.
How do I fix CVE-2023-43770?
Upgrade Roundcube Webmail to version 1.4.14+, 1.5.4+, or 1.6.3+ as directed by the Roundcube security release. Debian users should apply the official Debian security advisory package update. See the Remediation section for additional interim hardening steps including Content Security Policy configuration.
How severe is CVE-2023-43770?
CVE-2023-43770 is rated MEDIUM severity with a CVSS score of 6.1, but its real-world risk is considerably higher due to its 98.9th percentile EPSS score and confirmed active exploitation. The changed scope metric amplifies impact beyond the Roundcube application, and the vulnerability is easily triggered by viewing a malicious email — requiring no special user privileges or technical knowledge from the victim.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.