Roundcube stored XSS via crafted email runs attacker JavaScript in mailbox
Stored XSS in Roundcube 1.5.x through 1.5.7 and 1.6.x through 1.6.7 allows a crafted email to execute attacker JavaScript in a victim's mailbox session. CVSS 9.3. Patched August 2024.
- Vendor
- Roundcube
- Product
- Roundcube Webmail (1.5.x through 1.5.7; 1.6.x through 1.6.7)
- CVSS
- 9.3
- EPSS (exploit probability)
- 79.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Cross-site scripting in Roundcube’s message rendering path. A crafted inbound email abuses a desanitization issue in program/actions/mail/show.php (message_body()) to run attacker-controlled JavaScript inside the victim’s active mailbox session when the message is viewed. No user action beyond opening the email required.
Affected. Roundcube Webmail through 1.5.7 and 1.6.x through 1.6.7.
Exploitation status. Active. Proofpoint confirmed exploitation by the China-aligned cluster UNK_MassTraction (overlapping tooling with UNC5174) against U.S. and Canadian university physics and engineering departments. The XSS is not the end goal — it’s the first link in a chain: IceCube JavaScript payload harvests session cookies and 2FA material; access is then used to chain into CVE-2025-49113 for RCE. The combination means a phishing email can become full server compromise.
Patch. Roundcube released fixes in August 2024. Instances still running pre-patch versions remain valid ingress for this chain. There is no ambiguity about timing: UNK_MassTraction started the campaign with this flaw publicly patched.
What to do. Verify Roundcube version. Upgrade to 1.5.8+ or 1.6.8+. Treat unpatched Roundcube deployments as remote-access nodes, not just mail viewers — the same scrutiny applied to VPN concentrators.
Sources. NVD CVE-2024-42009 · Proofpoint Threat Insight: UNK_MassTraction campaign (via The Hacker News)
