Cross-Site Scripting in MDaemon Email Server Webmail

Successful exploitation allows execution of arbitrary JavaScript in the context of the victim’s authenticated MDaemon webmail session. This can enable session hijacking, theft of webmail credentials and mailbox contents, unauthorized access to email, collection of contacts and other mailbox data, and abuse of the victim’s session for further account actions. Reporting on in-the-wild exploitation also indicates the flaw was used in espionage operations to steal sensitive communications and, in some cases, facilitate bypass of additional account protections through webmail-accessible features.

If immediate patching is not possible, reduce exposure by restricting access to the MDaemon webmail interface to trusted networks or VPN users, applying additional filtering or sanitization controls for HTML email content where feasible, and monitoring for suspicious script-driven activity in webmail sessions. Enforce multifactor authentication, review for unauthorized application passwords or mailbox rule changes, and consider temporarily disabling or limiting HTML email rendering in exposed webmail workflows until the patch is applied. These measures do not eliminate the vulnerability but can reduce exploitation opportunities and post-exploitation impact.

Upgrade MDaemon Email Server to a fixed release. The vulnerability is reported as patched in MDaemon version 24.5.1 released in November 2024; use the vendor-provided patched build and ensure all webmail components are updated consistently across the deployment. After patching, review webmail access logs and affected accounts for signs of suspicious message access, session abuse, unauthorized mailbox changes, or credential compromise, and rotate credentials or revoke active sessions where compromise is suspected.