CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-42008

Critical Severity
Roundcube
SVRS
85/100
CVSSv3
9.3/10
EPSS
0.03422/1

CVE-2024-42008 is a critical Cross-Site Scripting (XSS) vulnerability in Roundcube email client. This flaw allows a remote attacker to steal and send emails of a victim. The vulnerability is located in rcmail_action_mail_get->run() in Roundcube versions 1.5.7 and earlier, as well as 1.6.x through 1.6.7.

This exploit is triggered through a malicious email attachment with a crafted Content-Type header. SOCRadar's SVRS score of 85 indicates this is a critical vulnerability, demanding immediate attention and patching. The presence of active exploits "In The Wild" further emphasizes the urgency. Successful exploitation could lead to significant data breaches and unauthorized access to sensitive information, impacting both individual users and organizations relying on the Roundcube platform.

TAGS
In The Wild
Exploit Avaliable
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:N
UI:R
S:C
C:H
I:H
A:N
PUBLICATION DATE2024-08-05
LAST MODIFIED2025-03-13
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-42008 is a Cross-Site Scripting (XSS) vulnerability in Roundcube, an open-source webmail client. This vulnerability allows a remote attacker to steal and send emails of a victim via a malicious email attachment served with a dangerous Content-Type header. The SVRS for this vulnerability is 30, indicating a moderate risk.

Key Insights

  • Exploitation: Active exploits have been published for this vulnerability.
  • Threat Actors: This vulnerability is being actively exploited by hackers.
  • CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.
  • Impact: This vulnerability could allow an attacker to steal sensitive information, such as passwords and financial data, from a victim's email account.

Mitigation Strategies

  • Update Roundcube: Update Roundcube to version 1.6.8 or later to patch this vulnerability.
  • Disable email attachments: Disable email attachments from untrusted sources.
  • Use a web application firewall (WAF): A WAF can help to block malicious requests that could exploit this vulnerability.
  • Educate users: Educate users about the risks of clicking on links or opening attachments from untrusted sources.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

TitleSoftware LinkDate
victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POChttps://github.com/victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC2025-02-13
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

Multiples vulnérabilités dans Roundcube (09 août 2024)
2025-04-01
Multiples vulnérabilités dans Roundcube (09 août 2024) | Le 4 août 2024, Roundcube a publié des correctifs concernant les vulnérabilités critiques CVE-2024-42008 et CVE-2024-42009 affectant son serveur de courriel. Ces vulnérabilités permettent des injections de code indirectes à distance (XSS) qui peuvent, par exemple, conduire à la récupération du...
ssi.gouv.fr
rss
forum
news
CVE-2024-42008 | RoundCube up to 1.5.7/1.6.7 Content-Type Header rcmail_action_mail_get cross site scripting (Nessus ID 208677)
vuldb.com2025-03-16
CVE-2024-42008 | RoundCube up to 1.5.7/1.6.7 Content-Type Header rcmail_action_mail_get cross site scripting (Nessus ID 208677) | A vulnerability classified as problematic has been found in RoundCube up to 1.5.7/1.6.7. This affects the function rcmail_action_mail_get of the component Content-Type Header Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as <a href="https://vuldb.com
vuldb.com
rss
forum
news
Data Breaches Digest - Week 32 2024
Dunkie ([email protected])2024-08-05
Data Breaches Digest - Week 32 2024 | Welcome to this week's Data Breaches Digest, a catalogue of links concerning Data Breaches and Cyber Security that were published on the Internet during the period between 5th August and 11th August 2024. 11th August <br
cve-2024-36268
cve-2024-42219
cve-2024-42009
dbdigest.com
Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords - The Hacker News
2024-08-07
Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords - The Hacker News | News Content: Cybersecurity researchers have disclosed details of security flaws in the Roundcube webmail software that could be exploited to execute malicious JavaScript in a victim's web browser and steal sensitive information from their account under specific circumstances. "When a victim views a malicious email in Roundcube sent by an attacker, the attacker can execute arbitrary JavaScript in the victim's browser," cybersecurity company Sonar said in an analysis published this week. "Attackers can abuse the vulnerability to steal emails, contacts, and the victim's email
cve-2024-42010
cve-2024-41637
cve-2024-42008
cve-2024-42009
Critical XSS Vulnerability In Roundcube Let Attackers Execute Arbitrary Code - CybersecurityNews
2024-08-09
Critical XSS Vulnerability In Roundcube Let Attackers Execute Arbitrary Code - CybersecurityNews | News Content: Roundcube, a widely adopted open-source webmail application, is included by default in the popular cPanel web hosting control panel, leading to millions of installations worldwide. The software is commonly used by universities and government agencies, making the email accounts of public sector employees a valuable target for Advanced Persistent Threat (APT) groups engaged in espionage. Cybersecurity researchers at Sonar Source recently discovered a critical XSS vulnerability in Roundcube (1.6.7 is vulnerable to CVE-2024-42009, while 1.5.7 and below are vulnerable to CVE-2024-42008) that
google.com
rss
forum
news

Social Media

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008) https://t.co/nNZzxIRV8c
0
0
0
Critical Roundcube XSS technical details: Desanitization, unsafe Content-Types, CSS exfiltration, and a Service Worker come together to persistently leak emails from a victim's browser. Read about it here: https://t.co/fOa2l0ujwV (CVE-2024-42008, CVE-2024-42009, CVE-2024-42010) https://t.co/fVurDab5Cm
0
10
15
The vulnerabilities are tracked as CVE-2024-42008 to 42010, and when exploited, allows an attacker to steal emails and contacts without authentication
1
0
0
CVE-2024-42008 Cross-Site Scripting in Roundcube Leads to Email Theft There is a Cross-Site Scripting (XSS) problem in the function rcmail_action_mail_get-&gt;run() found in Roundcube up to version 1.5.7 and from 1.... https://t.co/rzsCnXHsaQ
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
AppRoundcubewebmail

References

ReferenceLink
[email protected]https://github.com/roundcube/roundcubemail/releases
[email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.5.8
[email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
[email protected]https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
[email protected]https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
GITHUBhttps://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/

CWE Details

CWE IDCWE NameDescription
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence