[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2023-5631: XSS vulnerability in Roundcube webmail
From:       Valtteri Vuorikoski <vuori () notcom ! org>
Date:       2023-10-31 21:26:12
Message-ID: mehcc45ulnpbayvi4alil52gazey6mybvc2ugvmvxj25kqn7bf () 23o2kg6ldvdr
[Download RAW message or body]

Not associated with the project or ESET, but didn't see anything here about
this yet.

Roundcube is an open-source webmail client. Versions up to 1.6.4 are
vulnerable (including the 1.4.x and 1.5.x series) to an XSS exploit
caused by an issue in the sanitization of SVG image elements in HTML
emails. ESET describes CVE-2023-5631 as follows in their press release
at <https://www.eset.com/us/about/newsroom/press-releases/eset-research-winter-vivern-attacks-roundcube-webmail-servers-of-governments-in-europe-through-zero-1/>:


  By sending a specially crafted email message, attackers are able to
  load arbitrary JavaScript code in the context of the Roundcube user's
  browser window. No manual interaction other than viewing the message
  in a web browser is required. The final JavaScript payload can
  exfiltrate email messages to the command and control server of the
  group.

The Roundcube project has released new versions for each of the abovementioned
release series. The official release notification is at
<https://roundcube.net/news/2023/10/16/security-update-1.6.4-released>.

According to ESET, the vulnerability is being actively exploited to
target "governmental entities in Europe".

 -Valtteri


[prev in list] [next in list] [prev in thread] [next in thread]