---
title: "MDaemon CVE-2024-11182: Webmail XSS Used by APT28"
url: https://erroneo.us/security/briefs/mdaemon-cve-2024-11182-webmail-xss-roundpress/
description: "A webmail XSS in MDaemon Email Server before 24.5.1 was used as a zero-day by APT28 in Operation RoundPress. Confirm upgrades; check app passwords and 2FA."
type: security-brief
section: "Security Digest"
date_published: 2024-11-14
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-11182"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# MDaemon CVE-2024-11182: Webmail XSS Used by APT28

**Verdict: Check exposure.** Fixed since November 2024, so current servers are safe; the leftover risk is accounts whose app passwords or 2FA secrets were stolen before the upgrade, which the patch does not undo.

- **Who must act:** MDaemon administrators who ran a version before 24.5.1, especially those serving government, defense or other organizations of interest to Russian intelligence.
- **Who can relax:** MDaemon sites that upgraded to 24.5.1 or later in November 2024 and serve users who are unlikely espionage targets; other mail servers are not affected by this CVE.
- **Affected:** MDaemon Email Server up to and including 24.5.0 (CVE record); the record's description names 24.5.1c as the fixed build
- **Fixed:** MDaemon 24.5.1 (Nov 14, 2024) per MDaemon's release notes and ESET; Any later MDaemon release
- **CVEs:** CVE-2024-11182
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm every MDaemon server runs 24.5.1 or later, preferably a current release.
2. For servers that ran an older version into late 2024 or 2025, list App Passwords per user and revoke any the user did not create.
3. For users who received suspicious HTML mail in that window, reset their password and re-enroll two-factor authentication.
4. Load ESET's Operation RoundPress indicators into your mail, proxy and DNS monitoring.

### How to check if you are affected

- Search mailbox stores for messages with a noembed end tag inside a title attribute next to an img tag, the exploit pattern ESET describes.
- Review App Passwords and 2FA changes since November 2024 for accounts nobody can explain.
- Check proxy and DNS logs from user browsers against ESET's RoundPress indicators.
- Check whether mail stolen this way could have exposed credentials or contacts, and warn those parties.

## What happened

On November 1, 2024, ESET caught an email exploiting an unknown cross-site scripting bug in MDaemon Email Server's webmail. It was sent to two Ukrainian state-owned defense companies and a Ukrainian civil air transport company. ESET reported the bug to MDaemon the same day. MDaemon shipped 24.5.1 on November 14, 2024. Its [release notes](https://help.mdaemon.com/MDaemon/en/md245-relnotes.html) list item [28309], "fix to Webmail - XSS vulnerabilities." ESET, as CNA, published [CVE-2024-11182](https://www.cve.org/CVERecord?id=CVE-2024-11182) on November 15. It scores the bug CVSS 4.0 5.3 and credits Matthieu Faou.

The CVE record describes a stored XSS. An HTML email with JavaScript in an `img` tag runs that script in the recipient's webmail session. [ESET's May 15, 2025 report](https://www.welivesecurity.com/en/eset-research/operation-roundpress/) gives the detail. A `noembed` end tag hidden inside a `p` element's `title` attribute confuses MDaemon's HTML parser, which then renders the attacker's `img` tag. Opening the email is enough.

The script, which ESET calls SpyPress.MDAEMON, runs in the victim's browser tab. It harvests credentials with hidden "User" and "Password" fields that browsers and password managers fill in. It exfiltrates contacts, login history and messages, and steals the two-factor authentication secret. It also creates an App Password. ESET notes that MDaemon webmail did not seem to require a 2FA code for that, which gives the attacker lasting mailbox access from a mail client. The payload has no persistence of its own and reloads whenever the email is opened again. ESET attributes the campaign, Operation RoundPress, to Sednit (APT28) with medium confidence. The same operation hit Roundcube, Horde and Zimbra.

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11182) on May 19, 2025, four days after ESET's report, with a June 9 deadline.

## Who is affected

MDaemon Email Server through 24.5.0, per the CVE record's version data. The record's description names 24.5.1c as the fixed build. MDaemon's notes and ESET name 24.5.1. Any later release includes the fix.

## Do you really need to act?

For most MDaemon sites the patch is two years old, so the honest answer is check exposure. The bug needs a user to open a crafted email in webmail, and ESET says only data the victim's account can reach is exposed. But the damage outlives the fix. An App Password created or a 2FA secret stolen before the upgrade still works afterward. ESET's [announcement](https://www.eset.com/us/about/newsroom/research/eset-research-uncovers-operation-roundpress-russia-aligned-sednit-targets-entities-linked-to-the-ukraine-war-to-steal-confidential-data/) and report describe targets tied to the war in Ukraine, mostly Ukrainian government bodies and defense companies in Bulgaria and Romania. If your users fit that profile and your server was late to 24.5.1, review the accounts. If not, confirming the version is enough.

## What to do now

1. Confirm every MDaemon server runs 24.5.1 or later. Prefer a current release.
2. For servers that stayed below 24.5.1 into late 2024 or 2025, list each user's App Passwords and revoke any the user cannot account for.
3. Reset passwords and re-enroll 2FA for users who received suspicious HTML mail in that window.
4. Load ESET's [RoundPress indicators](https://github.com/eset/malware-ioc/tree/master/operation_roundpress) into mail, proxy and DNS monitoring.

## How to tell if you were hit

- Search the mailbox store for the exploit pattern, for example `findstr /s /i /m "</noembed>" "<mailbox-root>\*"`. Review hits that pair it with an `img` tag inside a `title` attribute.
- Review App Password creation and 2FA changes since November 2024 for activity users did not initiate.
- Check proxy and DNS logs from user workstations against ESET's indicators. The payload sends stolen data from the browser.
- If an account was hit, assume its mail and contacts were read. Warn correspondents about follow-on phishing.

## Timeline

- Nov 1, 2024 — ESET detects the exploit email and reports the bug to MDaemon.
- Nov 14, 2024 — MDaemon 24.5.1 fixes webmail XSS.
- Nov 15, 2024 — CVE-2024-11182 is published.
- May 15, 2025 — ESET publishes Operation RoundPress.
- May 19, 2025 — CISA adds the CVE to KEV.
- Jun 9, 2025 — Federal remediation deadline.

## Sources

1. [MDaemon — MDaemon 24.5 release notes](https://help.mdaemon.com/MDaemon/en/md245-relnotes.html)
2. [CVE record — CVE-2024-11182](https://www.cve.org/CVERecord?id=CVE-2024-11182)
3. [ESET Research — Operation RoundPress](https://www.welivesecurity.com/en/eset-research/operation-roundpress/)
4. [ESET — Operation RoundPress indicators of compromise](https://github.com/eset/malware-ioc/tree/master/operation_roundpress)
5. [CISA — Known Exploited Vulnerabilities: CVE-2024-11182](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11182)
6. [ESET — ESET Research uncovers Operation RoundPress (press release)](https://www.eset.com/us/about/newsroom/research/eset-research-uncovers-operation-roundpress-russia-aligned-sednit-targets-entities-linked-to-the-ukraine-war-to-steal-confidential-data/)

---
Source page: https://erroneo.us/security/briefs/mdaemon-cve-2024-11182-webmail-xss-roundpress/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt