Loading vulnerability…
CVE-2024-42009 is a cross-site scripting vulnerability in Roundcube Webmail affecting versions through 1.5.7 and 1.6.x through 1.6.7. The issue is caused by improper sanitization during HTML email rendering, described as a desanitization flaw in message_body() in program/actions/mail/show.php, with related processing through html4inline(). A crafted HTML email can persist attacker-controlled script-capable content that executes when the victim opens the message in the Roundcube webmail interface. The flaw has been described as allowing JavaScript execution via insufficient sanitization of HTML/JavaScript items, including abuse of event-handler behavior such as onanimationstart. Successful exploitation occurs in the victim’s browser within the authenticated Roundcube session and can be used to access mailbox content and session context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a compact proof-of-concept exploit set for CVE-2024-42009 targeting Roundcube Webmail 1.6.6 and earlier. It contains three functional artifacts: exploit.py, which generates and sends the malicious HTML email over SMTP; listener.py, which runs a simple HTTP server to receive exfiltrated data; and payload.html, which documents the injected HTML structure for manual inspection. The exploit is not part of a larger framework. The main exploit capability is stored XSS-based inbox exfiltration. exploit.py builds a malformed <body> tag whose unquoted attribute context injects a CSS animation trigger and an onanimationstart handler. That handler executes eval(atob(...)) on a base64-encoded JavaScript payload. When the victim opens the email inside Roundcube, the browser executes the script in the authenticated webmail context. The script then loops through message UIDs starting at 1, requesting each message from Roundcube's internal mail view endpoint until it encounters the error string indicating no more messages. All collected message content is then POSTed as JSON to an attacker-controlled HTTP listener. exploit.py uses only Python standard library modules (smtplib, base64, argparse, email.mime.*). It accepts attacker-controlled SMTP host, listener host/port, sender, recipient, and subject values, but the SMTP connection itself is hardcoded to port 25 in the send() function despite README text suggesting a configurable SMTP port. listener.py is a minimal BaseHTTPRequestHandler implementation that accepts OPTIONS and POST, enables permissive CORS headers, writes the received body to stolen_emails.json, and prints the number of recovered emails. payload.html is not executable by itself as delivered; it is a template/example showing the injection structure and intended JavaScript behavior. Overall, this is a real exploit PoC rather than a detector. It operationalizes delivery and collection for a stored XSS attack against vulnerable Roundcube instances, with a basic but functional exfiltration workflow.
This repository is a minimal Docker-based proof-of-concept for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail. It contains only two files: a README describing exploitation steps and a docker-compose.yml that provisions a local lab with docker-mailserver and a vulnerable Roundcube 1.6.7 instance. There is no standalone exploit script; the exploit is operationalized through documented manual steps using swaks to send a crafted HTML email. The main exploit capability is stored cross-site scripting via malicious HTML email content. The payload abuses Roundcube's HTML sanitization and later attribute reprocessing to create attribute-boundary confusion and reintroduce an event handler such as onanimationstart=alert(1). When the victim logs into Roundcube and opens the email, arbitrary JavaScript executes in the browser context of the Roundcube session. The demonstrated payload is a simple alert, so this is best classified as a PoC rather than a weaponized exploit. Repository structure and purpose: README.md explains the vulnerability, affected versions, setup, user creation, access details, exploitation steps, and mitigation. docker-compose.yml defines two services: a mailserver container exposing SMTP/IMAP-related ports and a Roundcube container exposing HTTP on localhost:8080. The compose file also defines persistent volumes and Roundcube mail settings pointing to the mailserver service. Overall, the repository's purpose is to let a researcher quickly reproduce and observe the stored XSS issue in a controlled local environment.
This repository is a proof-of-concept exploit for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail (versions 1.5.7, 1.6.x through 1.6.7). The exploit consists of a Python script ('exploit.py') that crafts and sends a malicious email to a target Roundcube instance via its contact form endpoint. The email contains a specially crafted HTML body with a base64-encoded JavaScript payload that leverages a desanitization issue in Roundcube's HTML parsing. When a victim opens the email, the payload executes in their browser, iterates through their inbox, and exfiltrates email contents to an attacker-controlled HTTP server. The script also implements a local HTTP server to receive and display the exfiltrated emails. The repository includes a README with detailed usage instructions, a requirements.txt for dependencies, and a .gitignore. The exploit is a functional PoC and does not include advanced stealth or weaponization features.
This repository is a Proof of Concept (PoC) exploit for CVE-2024-42009, targeting a cross-site scripting (XSS) vulnerability in an unspecified webmail application. The repository contains three files: a LICENSE, a README.md with detailed usage instructions, and the main exploit script (exploit.py). The exploit works by starting an HTTP listener on the attacker's machine to receive exfiltrated email data. It then sends crafted emails to the target webmail application, injecting a malicious HTML payload. When a victim opens the email, the XSS payload executes in their browser, fetches the content of their email, base64-encodes it, and sends it to the attacker's listener via an HTTP GET request. The exploit.py script automates both the listener and the payload injection process. The code is written in Python and uses the requests and BeautifulSoup libraries. The exploit is a functional PoC and does not include weaponized or highly automated features beyond the basic exfiltration workflow.
This repository contains a Python-based exploit for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail 1.6.7. The main file, exploit.py, serves two purposes: it runs an HTTP listener to capture exfiltrated email content and sends a malicious XSS payload to the target's contact form. The payload, when triggered in a victim's browser, fetches the victim's email content and sends it (base64-encoded) to the attacker's listener. The exploit is operational and requires the attacker to configure the target URL and their own listener IP/port. The README provides clear usage instructions and context about the vulnerability. No fake or detection-only scripts are present; the code is a working exploit. The only code file is exploit.py, written in Python, and the repository is small and focused.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
71 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cross-site scripting vulnerability in Roundcube that can be triggered by merely viewing a malicious email in a vulnerable version, allowing attacker-controlled JavaScript execution in the victim's browser and delivery of the IceCube payload.
A Roundcube cross-site scripting vulnerability used for initial access, enabling theft of credentials, session tokens, and cookies when a victim opens a crafted email in the webmail client.
A Roundcube cross-site scripting vulnerability used in a targeted campaign against university mailservers, enabling automatic exploitation when a victim opens a malicious email.
A Roundcube cross-site scripting vulnerability used to execute JavaScript in victims’ browsers and load the IceCube credential-stealing payload.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.