MDaemon CVE-2024-11182: Webmail XSS Used by APT28

What to do

1. Confirm every MDaemon server runs 24.5.1 or later, preferably a current release.
2. For servers that ran an older version into late 2024 or 2025, list App Passwords per user and revoke any the user did not create.
3. For users who received suspicious HTML mail in that window, reset their password and re-enroll two-factor authentication.
4. Load ESET's Operation RoundPress indicators into your mail, proxy and DNS monitoring.

How to check if you are affected or compromised

• Search mailbox stores for messages with a noembed end tag inside a title attribute next to an img tag, the exploit pattern ESET describes.
• Review App Passwords and 2FA changes since November 2024 for accounts nobody can explain.
• Check proxy and DNS logs from user browsers against ESET's RoundPress indicators.
• Check whether mail stolen this way could have exposed credentials or contacts, and warn those parties.

What happened#

On November 1, 2024, ESET caught an email exploiting an unknown cross-site scripting bug in MDaemon Email Server's webmail. It was sent to two Ukrainian state-owned defense companies and a Ukrainian civil air transport company. ESET reported the bug to MDaemon the same day. MDaemon shipped 24.5.1 on November 14, 2024. Its release notes list item [28309], "fix to Webmail - XSS vulnerabilities." ESET, as CNA, published CVE-2024-11182 on November 15. It scores the bug CVSS 4.0 5.3 and credits Matthieu Faou.

The CVE record describes a stored XSS. An HTML email with JavaScript in an img tag runs that script in the recipient's webmail session. ESET's May 15, 2025 report gives the detail. A noembed end tag hidden inside a p element's title attribute confuses MDaemon's HTML parser, which then renders the attacker's img tag. Opening the email is enough.

The script, which ESET calls SpyPress.MDAEMON, runs in the victim's browser tab. It harvests credentials with hidden "User" and "Password" fields that browsers and password managers fill in. It exfiltrates contacts, login history and messages, and steals the two-factor authentication secret. It also creates an App Password. ESET notes that MDaemon webmail did not seem to require a 2FA code for that, which gives the attacker lasting mailbox access from a mail client. The payload has no persistence of its own and reloads whenever the email is opened again. ESET attributes the campaign, Operation RoundPress, to Sednit (APT28) with medium confidence. The same operation hit Roundcube, Horde and Zimbra.

CISA added the CVE to the KEV catalog on May 19, 2025, four days after ESET's report, with a June 9 deadline.

Who is affected#

MDaemon Email Server through 24.5.0, per the CVE record's version data. The record's description names 24.5.1c as the fixed build. MDaemon's notes and ESET name 24.5.1. Any later release includes the fix.

Do you really need to act?#

For most MDaemon sites the patch is two years old, so the honest answer is check exposure. The bug needs a user to open a crafted email in webmail, and ESET says only data the victim's account can reach is exposed. But the damage outlives the fix. An App Password created or a 2FA secret stolen before the upgrade still works afterward. ESET's announcement and report describe targets tied to the war in Ukraine, mostly Ukrainian government bodies and defense companies in Bulgaria and Romania. If your users fit that profile and your server was late to 24.5.1, review the accounts. If not, confirming the version is enough.

What to do now#

1. Confirm every MDaemon server runs 24.5.1 or later. Prefer a current release.
2. For servers that stayed below 24.5.1 into late 2024 or 2025, list each user's App Passwords and revoke any the user cannot account for.
3. Reset passwords and re-enroll 2FA for users who received suspicious HTML mail in that window.
4. Load ESET's RoundPress indicators into mail, proxy and DNS monitoring.

How to tell if you were hit#

• Search the mailbox store for the exploit pattern, for example findstr /s /i /m "</noembed>" "<mailbox-root>\*". Review hits that pair it with an img tag inside a title attribute.
• Review App Password creation and 2FA changes since November 2024 for activity users did not initiate.
• Check proxy and DNS logs from user workstations against ESET's indicators. The payload sends stolen data from the browser.
• If an account was hit, assume its mail and contacts were read. Warn correspondents about follow-on phishing.

Timeline#

• Nov 1, 2024 — ESET detects the exploit email and reports the bug to MDaemon.
• Nov 14, 2024 — MDaemon 24.5.1 fixes webmail XSS.
• Nov 15, 2024 — CVE-2024-11182 is published.
• May 15, 2025 — ESET publishes Operation RoundPress.
• May 19, 2025 — CISA adds the CVE to KEV.
• Jun 9, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2024-11182 · KEV 2025-05-19 · An XSS issue was discovered in MDaemon Email Server before version 24.5.1c.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. MDaemon — MDaemon 24.5 release notes help.mdaemon.com
2. CVE record — CVE-2024-11182 cve.org
3. ESET Research — Operation RoundPress welivesecurity.com
4. ESET — Operation RoundPress indicators of compromise github.com
5. CISA — Known Exploited Vulnerabilities: CVE-2024-11182 cisa.gov
6. ESET — ESET Research uncovers Operation RoundPress (press release) eset.com