Loading vulnerability…
Stored XSS in Roundcube Webmail link-reference handling
CVE-2020-35730 is a stored cross-site scripting vulnerability in Roundcube Webmail affecting versions before 1.2.13, the 1.3 branch before 1.3.16, and the 1.4 branch before 1.4.10. The linkref_addindex function improperly handles a link reference element containing JavaScript in a plain-text email. Opening a crafted message in a vulnerable Roundcube interface can execute attacker-controlled JavaScript in the victim’s webmail context. APT28/Sednit and Winter Vivern exploited the vulnerability in espionage campaigns during 2023.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation executes arbitrary JavaScript within the victim’s Roundcube webmail session, enabling theft of credentials, email messages, and contact information. Roundcube payloads used in associated campaigns can capture credentials during reauthentication and create malicious Sieve rules that forward incoming email to an attacker-controlled account. Server-side shell execution reported in campaigns involving multiple Roundcube vulnerabilities is not established as a standalone consequence of CVE-2020-35730.
If you can’t patch tonight, do this now.
Enable two-factor authentication to reduce the risk of subsequent misuse of stolen credentials. This does not prevent JavaScript execution or data theft within an already authenticated webmail session and is not a substitute for patching. No vulnerability-specific workaround is established.
Patch, then assume compromise.
Upgrade affected Roundcube installations to version 1.2.13, 1.3.16, or 1.4.10 for the corresponding release branch, or preferably to the latest supported release containing this and subsequent security fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.