erroneo.us
Search all guides⌘K

Security Digest · May 19, 2024 · Vulnerability · Other

Roundcube CVE-2024-37383: SVG Animate XSS, Exploited

Roundcube before 1.5.7 and 1.6.7 ran script from SVG animate tags; used in 2024 to phish a government. Upgrade to 1.6.20 or 1.7.5 and check old installs.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

Fixed in May 2024 and exploited in a targeted phishing attack weeks later; any Roundcube on a current 1.6 or 1.7 release is safe, but forgotten installs on old builds are open to this and several later exploited bugs.

Who must act: Anyone running Roundcube before 1.5.7 or 1.6.x before 1.6.7, including copies bundled by hosting panels and distributions, and anyone still on the unsupported 1.5 branch.

Who can relax: Roundcube installs on 1.6.20 or 1.7.5 and later, and organizations that do not run Roundcube.

Affected
Roundcube Webmail before 1.5.7
Roundcube Webmail 1.6.x before 1.6.7
Fixed in
Roundcube 1.6.7 and 1.5.7 (May 19, 2024)
Recommended today: Roundcube 1.6.20 or 1.7.5 (Oct 19, 2026)
CVSS
6.1 (v3.1, NVD)
EPSS
73.3% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Medium

What to do

  1. Inventory every Roundcube instance, including panel bundles and distribution packages, and record its version.
  2. Upgrade to 1.6.20 or 1.7.5; stopping at 1.6.7 leaves later exploited bugs open.
  3. Move any 1.5.x install to 1.6 or 1.7; the 1.5 series is no longer maintained.
  4. Search mail stores for messages with SVG animate tags whose attributeName is 'href ' with a trailing space.
  5. If a user may have entered a password into a re-login prompt after opening such a message, reset it and review mail filters.

How to check if you are affected or compromised

  • Search stored mail for attributeName="href " or eval(atob( inside SVG content.
  • Check proxy and DNS logs for libcdn.org and rcm.codes, the exfiltration domains Positive Technologies reported.
  • Look for an unexpected Road map.docx download or a second login prompt reported by users.
  • Review ManageSieve filters for unknown forwarding or redirect rules.

What happened#

On May 19, 2024, Roundcube released 1.6.7 and 1.5.7 with three security fixes. The first was a cross-site scripting (XSS) flaw "in handling SVG animate attributes", reported by Valentin T. and Lutz Wolf of CrowdStrike (Roundcube notice, release notes). It became CVE-2024-37383 on June 7, 2024. The CVE record and NVD score it CVSS 3.1 6.1.

Positive Technologies explains the bug. Roundcube's sanitizer strips SVG <animate>, <set> and similar tags that target the href attribute. The comparison did not allow for spaces, so attributeName="href " with a trailing space slipped through. The attacker could then set href to JavaScript, which ran when the victim opened the message.

In September 2024, the same researchers found an email sent in June 2024 to a government organization in a CIS country. That was weeks after the fix, so the target was presumably unpatched. The message looked empty except for an attachment that did not display. Its body ran eval(atob(...)). The script saved an empty file called Road map.docx and tried to pull messages through the ManageSieve plugin. It also added a login form to the page, hoping the browser would autofill it or the user would re-enter their password. The credentials went to libcdn.org, a domain registered on June 6, 2024. The report also lists rcm.codes for sending mailbox content. Positive Technologies could not link the attack to a known group. CISA added the CVE to the KEV catalog on October 24, 2024, a few days after The Hacker News covered the report.

Who is affected#

Roundcube before 1.5.7 and 1.6.x before 1.6.7. Copies shipped by hosting control panels and Linux distributions follow their own schedules. Since 1.7.0 shipped on May 10, 2026, the 1.5 series "is no longer supported and maintained", and 1.6 gets only important security fixes.

Do you really need to act?#

For this CVE alone, mostly a version check. The fix is over two years old, and the only documented attack was a single targeted phishing email. The medium score is misleading, though. One opened email can steal a password and read mail, and Roundcube is a repeat target for state-linked groups. A server too old for this fix also lacks the August 2024 fix for CVE-2024-42009 and the fix for post-auth RCE CVE-2025-49113 in 1.6.11 and 1.5.10. Both are in KEV.

What to do now#

  1. Find every Roundcube instance. Check Settings > About, run grep RCMAIL_VERSION program/include/iniset.php in the install directory, or run dpkg -l roundcube-core on Debian systems.
  2. Upgrade to 1.6.20 or 1.7.5, released October 19, 2026.
  3. Move 1.5.x installs to 1.6 or 1.7.

How to tell if you were hit#

  • Search mail stores for the exploit marker. On Dovecot, doveadm search -A body 'attributeName="href ' is a starting point. Also search for eval(atob( in HTML parts.
  • Check proxy, DNS and firewall logs for libcdn.org and rcm.codes.
  • Ask whether users reported a second login prompt after opening a blank message.
  • Review ManageSieve filters for unknown redirect or forward rules. Reset the password of any account that may have been phished.

Timeline#

  • — Roundcube releases 1.6.7 and 1.5.7.
  • — The exfiltration domain libcdn.org is registered.
  • — CVE-2024-37383 is published.
  • June 2024 — The malicious email reaches a CIS government organization.
  • September 2024 — Positive Technologies finds the email.
  • — CISA adds the CVE to KEV, with a November 14 deadline.
  • — Roundcube 1.6.20 and 1.7.5, the current fixed releases, ship.

Vulnerability records

  • CVE-2024-37383 · KEV 2024-10-24 · Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Roundcube — Security updates 1.6.7 and 1.5.7 (May 19, 2024) roundcube.net
  2. Roundcube GitHub — Release 1.6.7 github.com
  3. CVE record — CVE-2024-37383 cve.org
  4. NVD — CVE-2024-37383 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2024-37383 cisa.gov
  6. Positive Technologies PT ESC — Fake attachment: Roundcube mail server attacks exploit CVE-2024-37383 vulnerability global.ptsecurity.com
  7. Roundcube — Security updates 1.6.8 and 1.5.8 (Aug 4, 2024) roundcube.net
  8. Roundcube — Roundcube 1.7.0 released (May 10, 2026) roundcube.net
  9. Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026) roundcube.net

Coverage and analysis

  1. The Hacker News — Hackers exploit Roundcube webmail XSS vulnerability to steal login credentials thehackernews.com