--- title: "Roundcube CVE-2024-42009: Open-to-Exploit Email XSS" url: https://erroneo.us/security/briefs/roundcube-cve-2024-42009-html-desanitization-xss/ description: "Viewing a crafted email in Roundcube before 1.6.8/1.5.8 runs attacker script. Used by UNC1151 in 2025 and a China-aligned actor in 2026. Upgrade, then hunt." type: security-brief section: "Security Digest" date_published: 2024-08-04 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2024-42009"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Roundcube CVE-2024-42009: Open-to-Exploit Email XSS **Verdict: Check exposure.** Fixed since August 2024 but still used against unpatched Roundcube in 2026, as the first step to a server takeover; confirm every install is on 1.6.20 or 1.7.5, and on anything that ran 1.6.7 or older, hunt for stolen sessions and rogue Service Workers. - **Who must act:** Anyone running Roundcube 1.6.7 or older or 1.5.7 or older, including copies bundled in hosting panels and distribution packages. - **Who can relax:** Roundcube installs kept current on 1.6.x or 1.7.x since August 2024, and organizations that do not run Roundcube. - **Affected:** Roundcube Webmail through 1.5.7; Roundcube Webmail 1.6.x through 1.6.7 - **Fixed:** Roundcube 1.6.8 and 1.5.8 (Aug 4, 2024); Recommended today: 1.6.20 or 1.7.5 (Oct 19, 2026) - **CVEs:** CVE-2024-42009 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory every Roundcube instance, including hosting-panel bundles, and record its version. 2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.8 is only the floor for this bug and leaves the exploited CVE-2025-49113 open. 3. Move any 1.5 install to 1.6 or 1.7, since 1.5 is no longer supported. 4. For users who opened a malicious message, reset passwords and 2FA, end all sessions, and unregister Service Workers on the webmail origin. 5. If the server also ran a version below 1.6.11, hunt it for web shells as well. ### How to check if you are affected - Check proxy and DNS logs for a.mpk-krakow[.]pl (CERT Polska, 2025) and for 45.150.109[.]151.sslip.io or 194.213.18[.]133.sslip.io on port 23088 (Proofpoint, 2026). - Search mail for CERT Polska's lure: senders irina.vingriena@gmail[.]com or julitaszczepanska38@gmail[.]com, subject '[!WAZNE] Faktura do numeru rezerwacji: S2500650676'. - Search stored HTML mail for onanimationstart handlers, which Proofpoint saw in the exploit. - In affected users' browsers, open developer tools, Application, Service Workers, and look for workers registered on the webmail site. - Review affected accounts for logins from unknown addresses and for phishing sent from them. ## What happened On August 4, 2024, Roundcube released 1.6.8 and 1.5.8 to fix three bugs reported by Oskar Zeino-Mahmalat of Sonar: two XSS flaws, CVE-2024-42009 and CVE-2024-42008, and a CSS information leak, CVE-2024-42010 ([notice](https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8), [release](https://github.com/roundcube/roundcubemail/releases/tag/1.6.8)). CVE-2024-42009 is the serious one. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-42009) scores it CVSS 3.1 9.3. [Sonar's write-up](https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/) calls it desanitization. Roundcube sanitized HTML mail correctly, then changed it. A later step in `message_body()` rewrote legacy `bgcolor`, `text` and `background` attributes on the `` tag with a regex that did not check whether it was matching inside an attribute value. A crafted message could use that to smuggle in an event handler. "All the victim user has to do is view a malicious email," Sonar wrote. The script can read and send mail, steal contacts and the password, and keep a foothold in the browser across restarts. Exploitation came ten months later. On June 5, 2025, [CERT Polska](https://cert.pl/en/posts/2025/06/unc1151-campaign-roundcube/) reported spearphishing against Polish entities, attributed with high confidence to UNC1151. Google and Mandiant associate that group with the Belarusian government. The lure was an urgent invoice email. Opening it installed a Service Worker in the browser, which captured the next real login and sent the credentials to the attackers. They then read mailboxes, downloaded address books and sent more phishing from some accounts. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009) on June 9, 2025, with a June 30 deadline ([alert](https://www.cisa.gov/news-events/alerts/2025/06/09/cisa-adds-two-known-exploited-vulnerabilities-catalog)). It is still in use. [Proofpoint](https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation) reported on July 7, 2026 that UNK_MassTraction, which it assesses as likely China-aligned, targeted physics and engineering departments at US and Canadian universities from May 2026. The email used an `onanimationstart` handler to load a stealer Proofpoint calls IceCube. It took passwords, two-factor material and cookies, then used the session to exploit CVE-2025-49113 for code execution on the server. ## Who is affected Roundcube through 1.5.7 and 1.6.x through 1.6.7 ([CVE record](https://www.cve.org/CVERecord?id=CVE-2024-42009)), including panel and distribution copies. The 1.5 series has been unsupported since 1.7.0 shipped on May 10, 2026 ([announcement](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released)). ## Do you really need to act? If you have stayed current since August 2024, no. Otherwise, yes. Opening the message is enough, two espionage groups have used it about a year apart, and in 2026 it opened the door to a server takeover. Proofpoint believes the targets were picked because they ran vulnerable versions. Upgrading closes the hole but does not undo a past hit. Stolen passwords, two-factor secrets and cookies stay valid, and a Service Worker can sit in a browser until removed. The server side of the 2026 chain is covered in our CVE-2025-49113 brief. ## What to do now 1. Inventory every Roundcube. Check Settings > About, or run `grep RCMAIL_VERSION program/include/iniset.php`. 2. Upgrade to 1.6.20 or 1.7.5 ([notice](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5)). Do not stop at 1.6.8. 3. Move 1.5 installs to 1.6 or 1.7. 4. For users who opened a lure, reset passwords and two-factor enrollment, end all sessions, and unregister Service Workers in developer tools under Application, Service Workers. ## How to tell if you were hit - Check proxy and DNS logs for a.mpk-krakow[.]pl, and for `/app/js/jquery.min.js` fetched from 45.150.109[.]151.sslip.io or 194.213.18[.]133.sslip.io on port 23088. - Search mail for CERT Polska's senders, irina.vingriena@gmail[.]com and julitaszczepanska38@gmail[.]com, for example `doveadm search -A from irina.vingriena@gmail.com`. - Search stored HTML mail for `onanimationstart`, and review affected accounts for unknown logins and outbound phishing. ## Timeline - Jun 18, 2024 — Sonar reports the bugs to Roundcube. - Aug 4, 2024 — Roundcube 1.6.8 and 1.5.8 are released. - Aug 5, 2024 — The CVE is published; Sonar posts a summary. - Jun 5, 2025 — CERT Polska reports the UNC1151 campaign. - Jun 9, 2025 — CISA adds the CVE to KEV. - May 10, 2026 — Roundcube 1.7.0 ships; 1.5 loses support. - Jul 7, 2026 — Proofpoint reports UNK_MassTraction, active since May 2026. - Oct 19, 2026 — Roundcube 1.6.20 and 1.7.5 are released. ## Sources 1. [Roundcube — Security updates 1.6.8 and 1.5.8 (Aug 4, 2024)](https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8) 2. [Roundcube GitHub — Roundcube Webmail 1.6.8 release](https://github.com/roundcube/roundcubemail/releases/tag/1.6.8) 3. [Sonar — Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail](https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/) 4. [CVE record — CVE-2024-42009](https://www.cve.org/CVERecord?id=CVE-2024-42009) 5. [NVD — CVE-2024-42009](https://nvd.nist.gov/vuln/detail/CVE-2024-42009) 6. [GitHub Advisory Database — GHSA-j43g-prf4-578j](https://github.com/advisories/GHSA-j43g-prf4-578j) 7. [CISA — Known Exploited Vulnerabilities: CVE-2024-42009](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009) 8. [CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Jun 9, 2025)](https://www.cisa.gov/news-events/alerts/2025/06/09/cisa-adds-two-known-exploited-vulnerabilities-catalog) 9. [CERT Polska — UNC1151 exploits Roundcube vulnerability in a spear phishing campaign](https://cert.pl/en/posts/2025/06/unc1151-campaign-roundcube/) 10. [Proofpoint — One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation](https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation) 11. [Roundcube — Roundcube 1.7.0 released (May 10, 2026)](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released) 12. [Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026)](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5) 13. [Help Net Security — Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)](https://www.helpnetsecurity.com/2024/08/07/cve-2024-42009-cve-2024-42008/) --- Source page: https://erroneo.us/security/briefs/roundcube-cve-2024-42009-html-desanitization-xss/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt