Zero-click XSS vulnerability in Roundcube webmail allows attackers to hijack user sessions
A critical zero-click XSS vulnerability in Roundcube webmail enables attackers to hijack user sessions and steal email content. The flaw exists in how the software processes HTML after sanitization, allowing malicious payloads to bypass existing defenses. Update your installations to version 1.6.8 or 1.5.8 immediately.
Summary
A critical Cross-Site Scripting (XSS) vulnerability has been identified in Roundcube webmail that allows an attacker to execute arbitrary JavaScript in a victim's browser. The flaw, tracked as CVE-2024-42009, can be triggered simply by the victim viewing a specially crafted email. Successful exploitation grants an attacker the ability to steal emails, contacts, and account passwords, or even send messages from the victim's account.
Because Roundcube is widely used by government agencies, NGOs, and ISPs-and included by default in cPanel hosting panels-the potential impact of this vulnerability is significant. Researchers have noted that similar vulnerabilities were previously exploited by the Winter Vivern APT group to target European government entities.
Technical details
The vulnerability stems from a desanitization issue occurring during the inline rendering of HTML emails. While Roundcube uses a custom server-side sanitizer called washtml to clean incoming messages, a secondary processing step introduces the flaw.
When an email is prepared for display via the message_body() function, it undergoes a transformation process in html4inline(). This function converts a full HTML document into a snippet by replacing the <body> tag with a <div> element and attempting to convert legacy body attributes into CSS styles.
The vulnerability exists because the regex used to parse these legacy attributes is faulty. It does not verify if it is matching inside an existing attribute value, which allows attackers to smuggle payloads that appear safe during initial sanitization but become active after the transformation. By creating a quote imbalance through this flawed parsing, an attacker can inject new event handler attributes into the resulting HTML snippet.
Affected products and fixed versions
The vulnerability affects several major branches of the Roundcube software. Administrators should identify their current version and upgrade to the corresponding stable release immediately.
| Affected Versions | Fixed Version |
|---|---|
| 1.5.x (through 1.5.7) | 1.5.8 |
| 1.6.x (through 1.6.7) | 1.6.8 |
Why this matters for defenders
This is a zero-click vulnerability, meaning the only requirement for exploitation is that a user views the malicious message within the webmail interface. This bypasses many traditional security layers that rely on active user interaction like clicking links or downloading attachments.
For organizations managing high-value targets-such as government or military entities-this flaw provides a path for session hijacking and lateral movement. An attacker can gain a persistent foothold in a browser across restarts, allowing them to exfiltrate data continuously or capture credentials the next time they are entered.
Defender guidance
Immediate patching is the only definitive remediation. If you cannot update instantly, monitor for unusual activity within your webmail environment.
- Update Immediately: Upgrade all productive installations of Roundcube to version 1.6.8 or 1.5.8.
- Credential Rotation: Users who suspect they have viewed a suspicious email should change their email passwords immediately.
- Clear Browser Data: After changing passwords, users should clear the site data/cache for the specific Roundcube instance to remove any potentially malicious persistent scripts.
- Monitor Logs: Watch for unusual patterns in webmail access or unexpected administrative changes.
Sources
- https://thehackernews.com/2026/07/suspected-china-aligned-hackers-exploit.html
- https://github.com/roundcube/roundcubemail/releases
- https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.8
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
