Loading vulnerability…
Cross-site scripting in Roundcube plain-text email link handling
CVE-2023-43770 is a cross-site scripting vulnerability in Roundcube Webmail affecting versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3. Improper sanitization of hyperlink text during string replacement allows crafted links in text/plain email messages to introduce executable browser content. Viewing a malicious message in a vulnerable webmail interface can execute attacker-controlled JavaScript in the victim’s webmail session without requiring a link click. The vulnerability has been exploited in cyberespionage campaigns, including Operation RoundPress, and is included in CISA’s Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits malicious JavaScript execution in the browser context of the victim’s webmail session, enabling credential theft and access to mailbox data available to that account. Observed exploitation enabled theft of user authentication data and creation of mail-forwarding filters through the ManageSieve plugin. Roundcube-focused payloads have also stolen emails and contacts and captured credentials during reauthentication. This XSS vulnerability alone does not establish arbitrary server-side code execution.
If you can’t patch tonight, do this now.
Monitor webmail infrastructure for XSS injection and investigate suspicious messages and account activity. For potentially compromised accounts, audit Sieve rules for unauthorized forwarding and rotate exposed credentials. Where the Roundcube two-factor authentication plugin was targeted, rotate exposed TOTP secrets and recovery codes. These measures address exploitation and its consequences but do not replace patching.
Patch, then assume compromise.
Upgrade affected installations to Roundcube 1.4.14, 1.5.4, or 1.6.3 or later in the corresponding release branch. Prefer a current supported release incorporating subsequent security fixes.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.