CVE-2024-42008
CRITICALRoundcube Webmail < 1.5.8 - Cross-Site Scripting via Malicious Email Attachment Content-Type Header
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-42008. PoCs published by victoni, rpgsec, Foxer131.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for exploiting CVE-2024-42008 (XSS via malicious XML attachment) and CVE-2024-42010 (HTML exfiltration via CSS injection) in Roundcube Webmail. The exploit chain involves sending a malicious email with an XML attachment and CSS import to exfiltrate the UID of the attachment, enabling XSS execution.
Description
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
Exploits (3)
This repository contains a functional proof-of-concept for exploiting CVE-2024-42008 (XSS via malicious XML attachment) and CVE-2024-42010 (HTML exfiltration via CSS injection) in Roundcube Webmail. The exploit chain involves sending a malicious email with an XML attachment and CSS import to exfiltrate the UID of the attachment, enabling XSS execution.
This repository contains a functional exploit for CVE-2024-42008, a Cross-Site Scripting (XSS) vulnerability in RoundCube webmail. The exploit leverages CSS animation properties to bypass content filters and execute arbitrary JavaScript in the context of the webmail application.
This repository contains a functional exploit for CVE-2024-42008 and CVE-2024-42009, targeting Roundcube 1.6.7. The exploit leverages XSS to exfiltrate email contents via a crafted payload delivered through a contact form.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N