CVE-2023-5631
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2023-5631 is a stored cross-site scripting (XSS) vulnerability in Roundcube Webmail that allows remote attackers to load and execute arbitrary JavaScript code in victims' browsers. The flaw exists in the HTML sanitization logic within rcube_washtml.php, where a specially crafted SVG document embedded in an HTML email can bypass the sanitizer and inject persistent malicious scripts. Roundcube versions before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 are affected by this XSS vulnerability. CISA has added CVE-2023-5631 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 85.2% indicates a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.4.15; >= 1.5.0, < 1.5.5; >= 1.6.0, < 1.6.4 |
| debian | debian linux | 10.0; 11.0; 12.0 |
| fedoraproject | fedora | 39 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- http://www.openwall.com/lists/oss-security/2023/11/01/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/11/01/3(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/11/17/2(Mailing List, Third Party Advisory)
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079(Mailing List, Patch)
- https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d(Patch)
- https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613(Patch)
- https://github.com/roundcube/roundcubemail/issues/9168(Exploit, Issue Tracking)
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.15(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.5(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.4(Release Notes)
- https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/(Mailing List)
- https://roundcube.net/news/2023/10/16/security-update-1.6.4-released(Release Notes)
- https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15(Release Notes)
- https://www.debian.org/security/2023/dsa-5531(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
Roundcube Webmail's HTML sanitizer fails to properly neutralize malicious content within SVG documents embedded in email messages. This cross-site scripting weakness allows an attacker to craft an HTML email containing a specially designed SVG element that bypasses the sanitization performed by rcube_washtml.php, resulting in stored XSS that executes in the context of the victim's webmail session.
Learn more: CWE-79 — Cross-site Scripting
Impact Analysis
CVE-2023-5631 is rated MEDIUM severity with a CVSS v3.1 score of 6.1, though the real-world impact is amplified by its active exploitation status. The vulnerability is remotely exploitable without physical access and requires low attack complexity with no authentication needed to send a malicious email. However, user interaction is required as the victim must open the crafted email in Roundcube Webmail for the XSS payload to execute. The scope is changed (S:C), meaning the XSS vulnerability can affect resources beyond the Roundcube application itself, such as stealing session tokens for other applications or redirecting users to phishing pages. Confidentiality (Low): the attacker can read email content, session cookies, and other data accessible within the user's browser session. Integrity (Low): the injected JavaScript can modify displayed email content, forge actions on behalf of the user, or inject additional malicious content. Despite the EPSS score of 85.2% (99th percentile) indicating widespread exploitation, the availability impact is none, as the vulnerability does not directly cause service disruption.
Exploit Maturity
Public exploit details are available for CVE-2023-5631 via the Roundcube issue tracker, which documents the vulnerability and its exploitation vector. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 16, 2023. The EPSS score of 85.2% (99th percentile) indicates a very high probability of exploitation, placing it among the most actively targeted vulnerabilities. The stored nature of this XSS makes it particularly dangerous in email contexts, as attackers can target multiple victims by sending crafted emails without requiring any further interaction beyond the victim reading the message.
Remediation
- Apply vendor mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Upgrade Roundcube Webmail to version 1.6.4, 1.5.5, or 1.4.15 depending on your release branch. Patches are available via the Roundcube releases page.
- Apply the specific security patches if a full version upgrade is not immediately feasible. The relevant commits addressing the SVG sanitization bypass are available in the Roundcube GitHub repository and can be cherry-picked to patch the rcube_washtml.php file in existing installations.
- Implement additional XSS protections by configuring Content Security Policy (CSP) headers for the Roundcube web application to restrict inline script execution and limit the sources from which scripts can be loaded. Enable HTTP-only and Secure flags on session cookies to reduce the impact of potential XSS exploitation.
- Review email logs and server access logs for indicators of compromise, including unusual email messages containing SVG elements with embedded JavaScript, unexpected session activity, or signs of account takeover. Monitor for anomalous login patterns from users who may have been targeted.
- Harden the Roundcube deployment by implementing strict input validation and output encoding practices, keeping the underlying PHP environment updated, and considering the deployment of a web application firewall (WAF) with XSS detection rules in front of the Roundcube instance.
Technical Details
CVE-2023-5631 is a stored cross-site scripting vulnerability rooted in the HTML sanitization component of Roundcube Webmail, specifically in the rcube_washtml.php file responsible for cleaning potentially dangerous HTML content from incoming email messages. The vulnerability exploits a gap in the sanitizer's handling of SVG (Scalable Vector Graphics) documents, where a specially crafted SVG element embedded within an HTML email can bypass the sanitization logic and inject persistent JavaScript code. As indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C), the attack is network-accessible with low complexity and requires no privileges, though user interaction is necessary (the victim must open the email). The changed scope (S:C) reflects that the injected JavaScript executes within the user's browser context, potentially affecting resources beyond the Roundcube application itself, such as other web applications sharing the same origin or browser session. The vulnerability is classified as stored XSS because the malicious payload persists in the email message and executes each time the email is viewed.
Frequently Asked Questions
Is CVE-2023-5631 being actively exploited?
Yes, CVE-2023-5631 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 16, 2023. The EPSS score of 85.2% places it at the 99th percentile, confirming widespread exploitation activity targeting Roundcube Webmail installations.
What products are affected by CVE-2023-5631?
CVE-2023-5631 affects Roundcube Webmail versions before 1.4.15, versions 1.5.x before 1.5.5, and versions 1.6.x before 1.6.4. The vulnerability also affects Debian Linux and Fedora distributions that package vulnerable versions of Roundcube. All three major release branches of Roundcube require patching.
How do I fix CVE-2023-5631?
Upgrade Roundcube Webmail to version 1.6.4, 1.5.5, or 1.4.15 depending on your installed release branch. These versions contain the fix for the SVG sanitization bypass in rcube_washtml.php. Additionally, implement Content Security Policy headers and review email logs for indicators of exploitation.
How severe is CVE-2023-5631?
CVE-2023-5631 is rated MEDIUM severity with a CVSS v3.1 score of 6.1. However, the real-world risk is elevated due to confirmed active exploitation and an EPSS score at the 99th percentile. The stored XSS nature of the vulnerability means attackers can target multiple victims by sending a single crafted email.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.