erroneo.us
Search all guides⌘K

Security Digest · Sep 15, 2023 · Vulnerability · Other

Roundcube CVE-2023-43770: Plain-Text Email XSS, Exploited

Stored XSS via link references in plain-text mail, fixed in Roundcube 1.6.3/1.5.4/1.4.14 and used in Sednit's RoundPress spying. Confirm upgrades, then hunt.

Published By erroneo.us Security Desk · Updated 3 min read13 sources

Our verdict

Check exposure

Patched in September 2023 and used by a Russia-linked espionage campaign within two weeks; confirm every Roundcube is on 1.6.20 or 1.7.5, and if an old install was exposed in 2023 or 2024, look for mail-forwarding rules that an upgrade does not remove.

Who must act: Anyone running Roundcube older than 1.6.3, 1.5.4 or 1.4.14, including copies bundled in hosting panels or old distribution packages, and anyone still on the unsupported 1.4 or 1.5 branches.

Who can relax: Installs kept current on Roundcube 1.6.x or 1.7.x, and organizations that do not run Roundcube.

Affected
Roundcube Webmail before 1.4.14
Roundcube Webmail 1.5.x before 1.5.4
Roundcube Webmail 1.6.x before 1.6.3
Fixed in
Roundcube 1.6.3 (Sep 15, 2023)
Roundcube 1.5.4 and 1.4.14 (Sep 18, 2023)
Recommended today: 1.6.20 or 1.7.5 (Oct 19, 2026)
CVSS
6.1 (v3.1, NVD)
EPSS
63.7% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Medium

What to do

  1. Inventory every Roundcube instance, including hosting-panel bundles, and record its version.
  2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.3 is only the floor for this bug.
  3. Move any 1.4 or 1.5 install to 1.6 or 1.7, since those branches no longer get fixes.
  4. If an unpatched install was reachable in late 2023 or 2024, review every user's Sieve filters for redirect rules.
  5. Reset passwords and end sessions for any user who opened a malicious message, and treat that mailbox as read by the attacker.

How to check if you are affected or compromised

  • Search mail stores for messages from katecohen1984@portugalmail[.]pt, the sender of a September 2023 exploit email ESET tied to Sednit.
  • List users' Sieve scripts and look for redirect rules to outside addresses, such as srezoska@skiff[.]com from ESET's report.
  • Grep stored plain-text mail for a bracketed link reference containing a script tag, the pattern the fix blocks.

What happened#

On September 15, 2023, Roundcube released 1.6.3 to fix a cross-site scripting (XSS) flaw "in handling of linkrefs in plain text messages," reported by Niraj Shivtarkar (notice). The same fix reached the older branches on September 18 in 1.5.4 and 1.4.14. The CVE record places the bug in rcube_string_replacer.php, the code that turns plain-text link references such as [1] https://example.com into links. The fix is small: the bracketed text may no longer contain < or >. Before it, a crafted reference could carry a script that ran when the message was displayed. NVD scores it CVSS 3.1 6.1.

Exploitation followed fast. In its Operation RoundPress report of May 15, 2025, ESET says it detected a spearphishing email exploiting CVE-2023-43770 on September 29, 2023. ESET links the campaign, with medium confidence, to Sednit, better known as APT28 or Fancy Bear. It says Sednit used an older Roundcube XSS, CVE-2020-35730, in 2023 and switched to this one in 2024. The payload, SpyPress.ROUNDCUBE, stole credentials, the address book and email. Some samples also created a Sieve rule that copies every incoming message to an attacker address.

CISA added the flaw to the KEV catalog on February 12, 2024, with a March 4 deadline (alert). Help Net Security noted that proof-of-concept code had been public for months.

Who is affected#

Roundcube before 1.4.14, 1.5.x before 1.5.4 and 1.6.x before 1.6.3, including copies shipped by hosting panels and Linux distributions. Since 1.7.0 shipped on May 10, 2026, the 1.5 series "is no longer supported and maintained," and 1.6 gets only important security fixes (announcement).

Do you really need to act?#

Mostly, just confirm your versions. The bug is three years old and patched, and the known use was targeted espionage. But the medium score undersells it: opening one message could hand over a mailbox.

Two things keep it relevant. First, a Sieve forwarding rule lives on the mail server. Upgrading Roundcube does not remove it, so a mailbox hit in 2023 or 2024 could still be copying mail today. Second, an install too old for this fix also lacks later ones. Roundcube now has 11 entries in KEV, including CVE-2023-5631, CVE-2024-42009, CVE-2025-49113 and CVE-2025-68461. A server on 1.6.3 is exposed to all four.

What to do now#

  1. Inventory every Roundcube instance. Check Settings > About, run grep RCMAIL_VERSION program/include/iniset.php in the install directory, or use dpkg -l roundcube-core for Debian packages.
  2. Upgrade to 1.6.20 or 1.7.5, released October 19, 2026 (notice).
  3. Move any 1.4 or 1.5 install to 1.6 or 1.7.
  4. If an unpatched install was reachable in late 2023 or 2024, run the checks below. Then reset passwords and end sessions for affected users.

How to tell if you were hit#

The exploit runs in the reader's browser, so web logs show little. Look at the mail and the Sieve scripts.

  • Search mail stores for ESET's sender, katecohen1984@portugalmail[.]pt. On Dovecot: doveadm search -A from katecohen1984@portugalmail.pt.
  • List each user's filters with doveadm sieve list -u user@example.com. Look for redirect actions to outside addresses. ESET's sample used srezoska@skiff[.]com.
  • Grep stored plain-text mail for a bracketed reference holding a script tag, for example grep -rlE '\[[^]]*<script' /var/vmail (adjust the path).

If you find a hit, delete the rule, reset the password and review what the mailbox held.

Timeline#

  • — Roundcube commits the fix.
  • — Roundcube 1.6.3 is released.
  • — Roundcube 1.5.4 and 1.4.14 follow.
  • — CVE-2023-43770 is published.
  • — ESET detects a RoundPress email exploiting the flaw.
  • — CISA adds it to KEV, with a March 4 deadline.
  • — ESET publishes Operation RoundPress.
  • — Roundcube 1.7.0 ships, and the 1.5 series loses support.
  • — Roundcube 1.6.20 and 1.7.5 are released.

Vulnerability records

  • CVE-2023-43770 · KEV 2024-02-12 · Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Roundcube — Security update 1.6.3 released (Sep 15, 2023) roundcube.net
  2. Roundcube GitHub — Roundcube Webmail 1.5.4 release github.com
  3. Roundcube GitHub — Roundcube Webmail 1.4.14 release github.com
  4. Roundcube GitHub — Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages github.com
  5. CVE record — CVE-2023-43770 cve.org
  6. NVD — CVE-2023-43770 nvd.nist.gov
  7. GitHub Advisory Database — GHSA-g3fv-4f2h-xwv4 github.com
  8. CISA — Known Exploited Vulnerabilities: CVE-2023-43770 cisa.gov
  9. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Feb 12, 2024) cisa.gov
  10. ESET Research — Operation RoundPress welivesecurity.com
  11. Roundcube — Roundcube 1.7.0 released (May 10, 2026) roundcube.net
  12. Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026) roundcube.net

Coverage and analysis

  1. Help Net Security — Roundcube webmail XSS vulnerability exploited by attackers (CVE-2023-43770) helpnetsecurity.com