CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
Description
CVE-2024-42009 is a critical cross-site scripting (XSS) vulnerability in Roundcube Webmail that allows a remote attacker to steal and send emails on behalf of a victim. The flaw exists in the message_body() function in the mail display component, where a desanitization issue allows crafted email messages to execute arbitrary JavaScript in the context of the victim's session. With a CVSS v3.1 base score of 9.3 (CRITICAL) and a Changed scope, the vulnerability can compromise both confidentiality and integrity across security boundaries without requiring any authentication. CISA has added CVE-2024-42009 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 91.22% at the 100th percentile indicates widespread active exploitation. Roundcube versions through 1.5.7 and 1.6.x through 1.6.7 are affected.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.5.8; >= 1.6.0, < 1.6.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/roundcube/roundcubemail/releases(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.8(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.8(Release Notes)
- https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8(Vendor Advisory)
- https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/(Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
The cross-site scripting weakness in CVE-2024-42009 occurs when Roundcube Webmail fails to properly sanitize HTML content within email messages before rendering them in the user's browser. The desanitization flaw in the message_body() function allows a crafted email to inject malicious JavaScript that executes in the context of the victim's authenticated session, enabling the attacker to steal emails or send messages on the victim's behalf.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
Impact Analysis
The impact of CVE-2024-42009 is critical with Confidentiality (High) and Integrity (High) fully compromised. The Scope is Changed (S:C), meaning the XSS attack can affect security domains beyond the Roundcube application itself. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N), but does require user interaction (UI:R) in the form of simply viewing a malicious email in Roundcube. Successful exploitation enables the attacker to steal emails, send messages on behalf of the victim, access address books, modify mail filters, and potentially pivot to other web applications using the same browser session. The EPSS score of 91.2% at the 100th percentile confirms widespread active exploitation. Roundcube is widely deployed by government agencies, ISPs, and enterprises, making this vulnerability particularly attractive to espionage-focused threat actors seeking to intercept sensitive communications.
Exploit Maturity
CVE-2024-42009 has extremely high exploit maturity, with an EPSS score of 91.22% at the 100th percentile, placing it among the most actively exploited web application vulnerabilities. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. Detailed technical analysis is available from Sonar Source, which describes the desanitization issue in detail. Roundcube XSS vulnerabilities have been historically favored by APT groups, including Winter Vivern (UAC-0114) and other state-sponsored actors, for targeted email espionage campaigns against government agencies and military organizations. The zero-click nature of the attack, where simply viewing an email triggers the exploit, makes it exceptionally dangerous for high-value targets.
Remediation
-
Upgrade Roundcube Webmail immediately to version 1.5.8 or 1.6.8, as detailed in the Roundcube security advisory. These versions fix the desanitization flaw in the message_body() function that enables the XSS attack.
-
Implement Content Security Policy (CSP) headers on the Roundcube installation to restrict the execution of inline scripts and limit the domains from which scripts can be loaded. A strict CSP policy can significantly reduce the impact of XSS vulnerabilities even before patching.
-
Deploy a web application firewall (WAF) in front of the Roundcube installation to filter potentially malicious email content. Configure rules to detect and block common XSS payloads in email messages before they reach the Roundcube application.
-
Audit email access logs for suspicious activity patterns that may indicate exploitation, including unusual email forwarding rules, sent messages the user did not compose, address book exports, or filter modifications. Review server-side mail logs for evidence of automated actions triggered through the XSS payload.
-
Consider additional email security hardening by disabling HTML email rendering where operationally feasible, implementing two-factor authentication for Roundcube access, and deploying browser-based XSS protections through appropriate HTTP security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy).
Technical Details
CVE-2024-42009 is a stored cross-site scripting (XSS) vulnerability in Roundcube Webmail's email display functionality, specifically in the message_body() function located in program/actions/mail/show.php. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) but requiring user interaction (UI:R) in the form of viewing the malicious email, with Changed scope (S:C) and high impact on confidentiality and integrity. The vulnerability exploits a desanitization issue where Roundcube's HTML sanitizer initially cleans potentially malicious HTML in email messages, but a subsequent processing step in message_body() inadvertently reverses some of the sanitization, allowing carefully crafted HTML/JavaScript to pass through to the rendered page. The attacker sends a specially crafted email that contains HTML structured to survive the initial sanitization but become executable after the desanitization step. Once the JavaScript executes in the victim's browser session, it has full access to the Roundcube interface context, enabling it to read emails, send messages, export contacts, and modify mail processing rules. The Changed scope (S:C) reflects the XSS payload's ability to interact with other web applications and browser resources beyond the Roundcube origin.
Frequently Asked Questions
Is CVE-2024-42009 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2024-42009 to the Known Exploited Vulnerabilities catalog. The EPSS score of 91.22% at the 100th percentile confirms widespread exploitation. Roundcube XSS vulnerabilities are historically favored by APT groups for targeted email espionage.
What products are affected by CVE-2024-42009?
Roundcube Webmail versions through 1.5.7 and versions 1.6.0 through 1.6.7 are affected. This includes all Roundcube installations that have not been updated to versions 1.5.8 or 1.6.8.
How do I fix CVE-2024-42009?
Upgrade Roundcube Webmail to version 1.5.8 or 1.6.8. Implement Content Security Policy headers and deploy a web application firewall as additional defense layers. Audit email access logs for signs of exploitation.
How severe is CVE-2024-42009?
CVE-2024-42009 is rated CRITICAL with a CVSS v3.1 score of 9.3 and a Changed scope. The vulnerability allows a remote attacker to steal and send emails by simply having the victim view a crafted email message, requiring no authentication or additional user interaction beyond opening the email.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.