--- title: "Roundcube CVE-2024-37383: SVG Animate XSS, Exploited" url: https://erroneo.us/security/briefs/roundcube-cve-2024-37383-svg-animate-xss/ description: "Roundcube before 1.5.7 and 1.6.7 ran script from SVG animate tags; used in 2024 to phish a government. Upgrade to 1.6.20 or 1.7.5 and check old installs." type: security-brief section: "Security Digest" date_published: 2024-05-19 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2024-37383"] severity: "medium" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Roundcube CVE-2024-37383: SVG Animate XSS, Exploited **Verdict: Check exposure.** Fixed in May 2024 and exploited in a targeted phishing attack weeks later; any Roundcube on a current 1.6 or 1.7 release is safe, but forgotten installs on old builds are open to this and several later exploited bugs. - **Who must act:** Anyone running Roundcube before 1.5.7 or 1.6.x before 1.6.7, including copies bundled by hosting panels and distributions, and anyone still on the unsupported 1.5 branch. - **Who can relax:** Roundcube installs on 1.6.20 or 1.7.5 and later, and organizations that do not run Roundcube. - **Affected:** Roundcube Webmail before 1.5.7; Roundcube Webmail 1.6.x before 1.6.7 - **Fixed:** Roundcube 1.6.7 and 1.5.7 (May 19, 2024); Recommended today: Roundcube 1.6.20 or 1.7.5 (Oct 19, 2026) - **CVEs:** CVE-2024-37383 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory every Roundcube instance, including panel bundles and distribution packages, and record its version. 2. Upgrade to 1.6.20 or 1.7.5; stopping at 1.6.7 leaves later exploited bugs open. 3. Move any 1.5.x install to 1.6 or 1.7; the 1.5 series is no longer maintained. 4. Search mail stores for messages with SVG animate tags whose attributeName is 'href ' with a trailing space. 5. If a user may have entered a password into a re-login prompt after opening such a message, reset it and review mail filters. ### How to check if you are affected - Search stored mail for attributeName="href " or eval(atob( inside SVG content. - Check proxy and DNS logs for libcdn.org and rcm.codes, the exfiltration domains Positive Technologies reported. - Look for an unexpected Road map.docx download or a second login prompt reported by users. - Review ManageSieve filters for unknown forwarding or redirect rules. ## What happened On May 19, 2024, Roundcube released 1.6.7 and 1.5.7 with three security fixes. The first was a cross-site scripting (XSS) flaw "in handling SVG animate attributes", reported by Valentin T. and Lutz Wolf of CrowdStrike ([Roundcube notice](https://roundcube.net/news/2024/05/19/security-updates-1.6.7-and-1.5.7), [release notes](https://github.com/roundcube/roundcubemail/releases/tag/1.6.7)). It became CVE-2024-37383 on June 7, 2024. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-37383) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-37383) score it CVSS 3.1 6.1. [Positive Technologies](https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/fake-attachment-roundcube-mail-server-attacks-exploit-cve-2024-37383-vulnerability/) explains the bug. Roundcube's sanitizer strips SVG ``, `` and similar tags that target the `href` attribute. The comparison did not allow for spaces, so `attributeName="href "` with a trailing space slipped through. The attacker could then set `href` to JavaScript, which ran when the victim opened the message. In September 2024, the same researchers found an email sent in June 2024 to a government organization in a CIS country. That was weeks after the fix, so the target was presumably unpatched. The message looked empty except for an attachment that did not display. Its body ran `eval(atob(...))`. The script saved an empty file called `Road map.docx` and tried to pull messages through the ManageSieve plugin. It also added a login form to the page, hoping the browser would autofill it or the user would re-enter their password. The credentials went to `libcdn.org`, a domain registered on June 6, 2024. The report also lists `rcm.codes` for sending mailbox content. Positive Technologies could not link the attack to a known group. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383) on October 24, 2024, a few days after [The Hacker News](https://thehackernews.com/2024/10/hackers-exploit-roundcube-webmail-xss.html) covered the report. ## Who is affected Roundcube before 1.5.7 and 1.6.x before 1.6.7. Copies shipped by hosting control panels and Linux distributions follow their own schedules. Since [1.7.0 shipped on May 10, 2026](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released), the 1.5 series "is no longer supported and maintained", and 1.6 gets only important security fixes. ## Do you really need to act? For this CVE alone, mostly a version check. The fix is over two years old, and the only documented attack was a single targeted phishing email. The medium score is misleading, though. One opened email can steal a password and read mail, and Roundcube is a repeat target for state-linked groups. A server too old for this fix also lacks the [August 2024 fix](https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8) for CVE-2024-42009 and the fix for post-auth RCE CVE-2025-49113 in 1.6.11 and 1.5.10. Both are in KEV. ## What to do now 1. Find every Roundcube instance. Check Settings > About, run `grep RCMAIL_VERSION program/include/iniset.php` in the install directory, or run `dpkg -l roundcube-core` on Debian systems. 2. Upgrade to [1.6.20 or 1.7.5](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5), released October 19, 2026. 3. Move 1.5.x installs to 1.6 or 1.7. ## How to tell if you were hit - Search mail stores for the exploit marker. On Dovecot, `doveadm search -A body 'attributeName="href '` is a starting point. Also search for `eval(atob(` in HTML parts. - Check proxy, DNS and firewall logs for `libcdn.org` and `rcm.codes`. - Ask whether users reported a second login prompt after opening a blank message. - Review ManageSieve filters for unknown redirect or forward rules. Reset the password of any account that may have been phished. ## Timeline - May 19, 2024 — Roundcube releases 1.6.7 and 1.5.7. - Jun 6, 2024 — The exfiltration domain libcdn.org is registered. - Jun 7, 2024 — CVE-2024-37383 is published. - June 2024 — The malicious email reaches a CIS government organization. - September 2024 — Positive Technologies finds the email. - Oct 24, 2024 — CISA adds the CVE to KEV, with a November 14 deadline. - Oct 19, 2026 — Roundcube 1.6.20 and 1.7.5, the current fixed releases, ship. ## Sources 1. [Roundcube — Security updates 1.6.7 and 1.5.7 (May 19, 2024)](https://roundcube.net/news/2024/05/19/security-updates-1.6.7-and-1.5.7) 2. [Roundcube GitHub — Release 1.6.7](https://github.com/roundcube/roundcubemail/releases/tag/1.6.7) 3. [CVE record — CVE-2024-37383](https://www.cve.org/CVERecord?id=CVE-2024-37383) 4. [NVD — CVE-2024-37383](https://nvd.nist.gov/vuln/detail/CVE-2024-37383) 5. [CISA — Known Exploited Vulnerabilities: CVE-2024-37383](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-37383) 6. [Positive Technologies PT ESC — Fake attachment: Roundcube mail server attacks exploit CVE-2024-37383 vulnerability](https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/fake-attachment-roundcube-mail-server-attacks-exploit-cve-2024-37383-vulnerability/) 7. [Roundcube — Security updates 1.6.8 and 1.5.8 (Aug 4, 2024)](https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8) 8. [Roundcube — Roundcube 1.7.0 released (May 10, 2026)](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released) 9. [Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026)](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5) 10. [The Hacker News — Hackers exploit Roundcube webmail XSS vulnerability to steal login credentials](https://thehackernews.com/2024/10/hackers-exploit-roundcube-webmail-xss.html) --- Source page: https://erroneo.us/security/briefs/roundcube-cve-2024-37383-svg-animate-xss/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt