erroneo.us
Search all guides⌘K

Security Digest · Aug 4, 2024 · Vulnerability · Other

Roundcube CVE-2024-42009: Open-to-Exploit Email XSS

Viewing a crafted email in Roundcube before 1.6.8/1.5.8 runs attacker script. Used by UNC1151 in 2025 and a China-aligned actor in 2026. Upgrade, then hunt.

Published By erroneo.us Security Desk · Updated 3 min read13 sources

Our verdict

Check exposure

Fixed since August 2024 but still used against unpatched Roundcube in 2026, as the first step to a server takeover; confirm every install is on 1.6.20 or 1.7.5, and on anything that ran 1.6.7 or older, hunt for stolen sessions and rogue Service Workers.

Who must act: Anyone running Roundcube 1.6.7 or older or 1.5.7 or older, including copies bundled in hosting panels and distribution packages.

Who can relax: Roundcube installs kept current on 1.6.x or 1.7.x since August 2024, and organizations that do not run Roundcube.

Affected
Roundcube Webmail through 1.5.7
Roundcube Webmail 1.6.x through 1.6.7
Fixed in
Roundcube 1.6.8 and 1.5.8 (Aug 4, 2024)
Recommended today: 1.6.20 or 1.7.5 (Oct 19, 2026)
CVSS
9.3 (v3.1, NVD)
EPSS
82.9% (percentile 99.7)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every Roundcube instance, including hosting-panel bundles, and record its version.
  2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.8 is only the floor for this bug and leaves the exploited CVE-2025-49113 open.
  3. Move any 1.5 install to 1.6 or 1.7, since 1.5 is no longer supported.
  4. For users who opened a malicious message, reset passwords and 2FA, end all sessions, and unregister Service Workers on the webmail origin.
  5. If the server also ran a version below 1.6.11, hunt it for web shells as well.

How to check if you are affected or compromised

  • Check proxy and DNS logs for a.mpk-krakow[.]pl (CERT Polska, 2025) and for 45.150.109[.]151.sslip.io or 194.213.18[.]133.sslip.io on port 23088 (Proofpoint, 2026).
  • Search mail for CERT Polska's lure: senders irina.vingriena@gmail[.]com or julitaszczepanska38@gmail[.]com, subject '[!WAZNE] Faktura do numeru rezerwacji: S2500650676'.
  • Search stored HTML mail for onanimationstart handlers, which Proofpoint saw in the exploit.
  • In affected users' browsers, open developer tools, Application, Service Workers, and look for workers registered on the webmail site.
  • Review affected accounts for logins from unknown addresses and for phishing sent from them.

What happened#

On August 4, 2024, Roundcube released 1.6.8 and 1.5.8 to fix three bugs reported by Oskar Zeino-Mahmalat of Sonar: two XSS flaws, CVE-2024-42009 and CVE-2024-42008, and a CSS information leak, CVE-2024-42010 (notice, release). CVE-2024-42009 is the serious one. NVD scores it CVSS 3.1 9.3.

Sonar's write-up calls it desanitization. Roundcube sanitized HTML mail correctly, then changed it. A later step in message_body() rewrote legacy bgcolor, text and background attributes on the <body> tag with a regex that did not check whether it was matching inside an attribute value. A crafted message could use that to smuggle in an event handler. "All the victim user has to do is view a malicious email," Sonar wrote. The script can read and send mail, steal contacts and the password, and keep a foothold in the browser across restarts.

Exploitation came ten months later. On June 5, 2025, CERT Polska reported spearphishing against Polish entities, attributed with high confidence to UNC1151. Google and Mandiant associate that group with the Belarusian government. The lure was an urgent invoice email. Opening it installed a Service Worker in the browser, which captured the next real login and sent the credentials to the attackers. They then read mailboxes, downloaded address books and sent more phishing from some accounts. CISA added the CVE to the KEV catalog on June 9, 2025, with a June 30 deadline (alert).

It is still in use. Proofpoint reported on July 7, 2026 that UNK_MassTraction, which it assesses as likely China-aligned, targeted physics and engineering departments at US and Canadian universities from May 2026. The email used an onanimationstart handler to load a stealer Proofpoint calls IceCube. It took passwords, two-factor material and cookies, then used the session to exploit CVE-2025-49113 for code execution on the server.

Who is affected#

Roundcube through 1.5.7 and 1.6.x through 1.6.7 (CVE record), including panel and distribution copies. The 1.5 series has been unsupported since 1.7.0 shipped on May 10, 2026 (announcement).

Do you really need to act?#

If you have stayed current since August 2024, no. Otherwise, yes. Opening the message is enough, two espionage groups have used it about a year apart, and in 2026 it opened the door to a server takeover. Proofpoint believes the targets were picked because they ran vulnerable versions.

Upgrading closes the hole but does not undo a past hit. Stolen passwords, two-factor secrets and cookies stay valid, and a Service Worker can sit in a browser until removed. The server side of the 2026 chain is covered in our CVE-2025-49113 brief.

What to do now#

  1. Inventory every Roundcube. Check Settings > About, or run grep RCMAIL_VERSION program/include/iniset.php.
  2. Upgrade to 1.6.20 or 1.7.5 (notice). Do not stop at 1.6.8.
  3. Move 1.5 installs to 1.6 or 1.7.
  4. For users who opened a lure, reset passwords and two-factor enrollment, end all sessions, and unregister Service Workers in developer tools under Application, Service Workers.

How to tell if you were hit#

  • Check proxy and DNS logs for a.mpk-krakow[.]pl, and for /app/js/jquery.min.js fetched from 45.150.109[.]151.sslip.io or 194.213.18[.]133.sslip.io on port 23088.
  • Search mail for CERT Polska's senders, irina.vingriena@gmail[.]com and julitaszczepanska38@gmail[.]com, for example doveadm search -A from irina.vingriena@gmail.com.
  • Search stored HTML mail for onanimationstart, and review affected accounts for unknown logins and outbound phishing.

Timeline#

  • — Sonar reports the bugs to Roundcube.
  • — Roundcube 1.6.8 and 1.5.8 are released.
  • — The CVE is published; Sonar posts a summary.
  • — CERT Polska reports the UNC1151 campaign.
  • — CISA adds the CVE to KEV.
  • — Roundcube 1.7.0 ships; 1.5 loses support.
  • — Proofpoint reports UNK_MassTraction, active since May 2026.
  • — Roundcube 1.6.20 and 1.7.5 are released.

Vulnerability records

  • CVE-2024-42009 · KEV 2025-06-09 · A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Roundcube — Security updates 1.6.8 and 1.5.8 (Aug 4, 2024) roundcube.net
  2. Roundcube GitHub — Roundcube Webmail 1.6.8 release github.com
  3. Sonar — Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail sonarsource.com
  4. CVE record — CVE-2024-42009 cve.org
  5. NVD — CVE-2024-42009 nvd.nist.gov
  6. GitHub Advisory Database — GHSA-j43g-prf4-578j github.com
  7. CISA — Known Exploited Vulnerabilities: CVE-2024-42009 cisa.gov
  8. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Jun 9, 2025) cisa.gov
  9. CERT Polska — UNC1151 exploits Roundcube vulnerability in a spear phishing campaign cert.pl
  10. Proofpoint — One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation proofpoint.com
  11. Roundcube — Roundcube 1.7.0 released (May 10, 2026) roundcube.net
  12. Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026) roundcube.net

Coverage and analysis

  1. Help Net Security — Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008) helpnetsecurity.com