A Cross-Site Scripting vulnerability in Roundcube through 1

CVE-2024-42009 is a stored/reflected XSS in Roundcube's message_body() function inside program/actions/mail/show.php. The function fails to properly desanitize certain HTML constructs (notably crafted href animations and SVG attributes) before rendering the message. When a victim simply opens the malicious email in the Roundcube UI, attacker-controlled JavaScript executes in the origin of the webmail, granting full DOM access to the authenticated mailbox. Affected: Roundcube ≤ 1.5.7 and 1.6.x through 1.6.7; fixed in 1.5.8 and 1.6.8.

The vendor's CRITICAL / 9.3 label matches reality — and if anything understates operational risk. Unlike most XSS, delivery is via *email* (bypasses browser SOP concerns), user interaction is a single email open (not a click), and the payload runs inside a session that stores plaintext credentials, 2FA cookies, and every historical message. CISA KEV listed. Sonar disclosed, and CERT.PL has documented Belarus-linked UNC1151 spearphishing chains stealing credentials via this exact bug. Do not treat this as garden-variety XSS.

Why this verdict

• KEV + nation-state usage: CISA KEV listing plus documented UNC1151 and China-aligned campaigns collapse any 'wait and see' argument.
• Preauth delivery, single-open detonation: UI:R is satisfied by the victim merely *opening* the message — not clicking a link, not enabling content. This is functionally zero-click for any user who reads mail.
• Role multiplier — webmail is an identity boundary: Roundcube sessions terminate in mailbox contents (regulatory data, password-reset links, MFA seed emails) *and* the IceCube payload steals browser cred stores. Blast radius = the victim's entire identity, and via password-reset abuse, downstream SSO tenants. Floor = CRITICAL.
• Exposure is large: ~130k+ internet-facing instances (Shodan) with heavy concentration in shared hosting (cPanel), academic, and EU government — meaning many enterprise M&A/subsidiary environments run Roundcube even if the mothership uses M365.
• Patch friction is negligible: upstream fix landed in 1.5.8/1.6.8 nearly two years ago; distro backports are available. No excuse holds up.

Why not higher?

There is no higher bucket than CRITICAL. Score sits at 9.3 rather than 10.0 because impact is bounded at the user/mailbox and downstream identity — there is no direct RCE on the Roundcube host itself, and availability is not directly affected.

Why not lower?

Downgrading to HIGH would require ignoring KEV status, ignoring active nation-state exploitation, and ignoring the fact that a single email view detonates the chain. None of the usual friction levers (needs auth, needs LAN position, narrow version range, low install base) apply here — this is *the* canonical fully-external, fully-weaponized webmail bug.

1. Upgrade Roundcube to 1.6.8 / 1.5.8 or later immediately — This is the only complete fix. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL. On Debian/Ubuntu use the security-repo backport; on cPanel push the vendor RPM (cpanel-roundcubemail ≥ patched build). No config change substitutes for the patch.
2. Block inbound HTML mail with SVG animate / crafted href constructs at the gateway — As a stopgap while you stage the upgrade, add a Proofpoint/Mimecast/EOP transport rule to quarantine messages containing <svg><animate ...> or href values matching the public PoC signature. Buys you days, not weeks.
3. Force a global Roundcube session invalidation and password reset for high-value users — Assume compromise for any account that opened untrusted mail between disclosure (Aug 2024) and your patch date. Rotate credentials, revoke OAuth grants, and re-enrol MFA.
4. Enable and tighten Roundcube's Content-Security-Policy — Set a strict CSP (default-src 'self'; script-src 'self') via reverse-proxy header. Won't fully block the bug on unpatched hosts (Roundcube's own scripts are same-origin) but breaks most out-of-the-box PoCs that rely on inline handlers.
5. Front Roundcube with a WAF rule inspecting rendered message HTML — Deploy a Modsec/Coraza rule that blocks message-body responses containing the animate/attributeName pattern signature published by Sonar. Deploy within 72 hours.
6. Alert on abnormal Roundcube send-mail API velocity — The IceCube payload calls the send endpoint at machine speed. A simple SIEM rule (>5 sent messages per session per minute) reliably catches active exfiltration.

Run on each Roundcube host as any user (root not required for version detection). Invoke: ./check-cve-2024-42009.sh /var/www/roundcubemail. Pass the Roundcube install root as $1; defaults to /var/www/roundcubemail. Exit code 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

#!/usr/bin/env bash
# noisgate check for CVE-2024-42009 (Roundcube XSS)
# Fixed in: 1.5.8, 1.6.8
set -u
ROOT="${1:-/var/www/roundcubemail}"

fail() { echo "UNKNOWN: $1"; exit 2; }

# 1. Locate version
VERSION_FILE="$ROOT/program/include/iniset.php"
INDEX_FILE="$ROOT/index.php"
VERSION=""

if [ -f "$ROOT/program/lib/Roundcube/bootstrap.php" ]; then
  VERSION=$(grep -Eo "RCMAIL_VERSION',\s*'[0-9.]+(-[a-z0-9]+)?" "$ROOT/program/lib/Roundcube/bootstrap.php" 2>/dev/null | grep -Eo "[0-9]+\.[0-9]+\.[0-9]+")
fi

if [ -z "$VERSION" ] && [ -f "$INDEX_FILE" ]; then
  VERSION=$(grep -Eo "RCMAIL_VERSION',\s*'[0-9.]+" "$INDEX_FILE" 2>/dev/null | grep -Eo "[0-9]+\.[0-9]+\.[0-9]+")
fi

# Debian/RPM package fallback
if [ -z "$VERSION" ]; then
  if command -v dpkg-query >/dev/null 2>&1; then
    VERSION=$(dpkg-query -W -f='${Version}' roundcube-core 2>/dev/null | grep -Eo "[0-9]+\.[0-9]+\.[0-9]+" | head -n1)
  fi
fi
if [ -z "$VERSION" ] && command -v rpm >/dev/null 2>&1; then
  VERSION=$(rpm -q --qf '%{VERSION}\n' roundcubemail 2>/dev/null | grep -Eo "[0-9]+\.[0-9]+\.[0-9]+" | head -n1)
fi

[ -z "$VERSION" ] && fail "could not detect Roundcube version under $ROOT"

echo "Detected Roundcube version: $VERSION"

# 2. Compare against fixed versions
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

vulnerable=0
if [ "$MAJOR" -lt 1 ]; then vulnerable=1
elif [ "$MAJOR" -eq 1 ]; then
  if [ "$MINOR" -lt 5 ]; then vulnerable=1
  elif [ "$MINOR" -eq 5 ] && [ "$PATCH" -lt 8 ]; then vulnerable=1
  elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -lt 8 ]; then vulnerable=1
  fi
fi

# 3. Distro backport override — check advisory-note file when patched by distro
if [ $vulnerable -eq 1 ] && command -v dpkg-query >/dev/null 2>&1; then
  PKGVER=$(dpkg-query -W -f='${Version}' roundcube-core 2>/dev/null)
  case "$PKGVER" in
    *deb12u3*|*deb12u4*|*deb12u5*|*deb11u4*|*deb11u5*) vulnerable=0; echo "Debian security backport detected: $PKGVER" ;;
  esac
fi

if [ $vulnerable -eq 1 ]; then
  echo "VULNERABLE: $VERSION is affected by CVE-2024-42009 — upgrade to 1.5.8 / 1.6.8+"
  exit 1
fi

echo "PATCHED: $VERSION is not affected by CVE-2024-42009"
exit 0

Sources

1. NVD — CVE-2024-42009
2. Sonar root-cause writeup
3. CERT.PL — UNC1151 Roundcube campaign
4. TheHackerNews — China-aligned exploitation of Roundcube
5. HelpNetSecurity coverage
6. GitHub PoC — 0xbassiouny1337/CVE-2024-42009
7. Snyk advisory (Debian package view)
8. SentinelOne vulnerability database entry