Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords

Aug 07, 2024Ravie LakshmananEmail Security / Vulnerability

Cybersecurity researchers have disclosed details of security flaws in the Roundcube webmail software that could be exploited to execute malicious JavaScript in a victim’s web browser and steal sensitive information from their account under specific circumstances.

“When a victim views a malicious email in Roundcube sent by an attacker, the attacker can execute arbitrary JavaScript in the victim’s browser,” cybersecurity company Sonar said in an analysis published this week.

“Attackers can abuse the vulnerability to steal emails, contacts, and the victim’s email password as well as send emails from the victim’s account.”

Following responsible disclosure on June 18, 2024, the three vulnerabilities have been addressed in Roundcube versions 1.6.8 and 1.5.8 released on August 4, 2024.

The list of vulnerabilities is as follows –

• CVE-2024-42008 – A cross-site scripting flaw via a malicious email attachment served with a dangerous Content-Type header
• CVE-2024-42009 – A cross-site scripting flaw that arises from post-processing of sanitized HTML content
• CVE-2024-42010 – An information disclosure flaw that stems from insufficient CSS filtering

Successful exploitation of the aforementioned flaws could allow unauthenticated attackers to steal emails and contacts, as well as send emails from a victim’s account, but after viewing a specially crafted email in Roundcube.

“Attackers can gain a persistent foothold in the victim’s browser across restarts, allowing them to exfiltrate emails continuously or steal the victim’s password the next time it is entered,” security researcher Oskar Zeino-Mahmalat said.

“For a successful attack, no user interaction beyond viewing the attacker’s email is required to exploit the critical XSS vulnerability (CVE-2024-42009). For CVE-2024-42008, a single click by the victim is needed for the exploit to work, but the attacker can make this interaction unobvious for the user.”

Additional technical details about the issues have been withheld to give time for users to update to the latest version, and in light of the fact that flaws in the webmail software have been repeatedly exploited by nation-state actors like APT28, Winter Vivern, and TAG-70.

The findings come as details have emerged about a maximum-severity local privilege escalation flaw in the RaspAP open-source project (CVE-2024-41637, CVSS score: 10.0) that allows an attacker to elevate to root and execute several critical commands. The vulnerability has been addressed in version 3.1.5.

“The www-data user has write access to the restapi.service file and also possesses sudo privileges to execute several critical commands without a password,” a security researcher who goes by the online alias 0xZon1 said. “This combination of permissions allows an attacker to modify the service to execute arbitrary code with root privileges, escalating their access from www-data to root.”