CVE-2024-42009

CRITICALCISA KEVNuclei

RoundCube Webmail Cross-Site Scripting Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-42009 has a selected CVSS score of 9.3 (critical); EIP currently links 7 repository PoCs, 1 Nuclei template, and 2 lab environments. CISA lists CVE-2024-42009 in KEV.

Description

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Jun 9, 2025 · CISA
VulnCheck KEV
Listed · Jun 5, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
7
Nuclei templates
1
Lab environments
2

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 20, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Roundcube Webmail

Browse Roundcube / Roundcube Webmail
VulnCheckVersion data not supplied

Webmail

Browse Roundcube / Webmail
CISAVersion data not supplied

Proofs of concept

7

Repository PoCs

GitHubShubhankargupta691/CVE-2024-42009Repository PoCby Shubhankargupta6910Scanner11 files

788.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a set of Nuclei templates and documentation for detecting CVE-2024-42009, a reflected XSS vulnerability in Roundcube. The templates send HTTP requests with crafted payloads and use matchers to check for reflection of markers or out-of-band callbacks, but do not execute the XSS payload in a browser or perform any exploitation actions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of two Nuclei YAML templates and a README for CVE-2024-42009, a reflected XSS vulnerability in Roundcube. The templates use standard Nuclei features (HTTP requests, matchers, extractors, Interactsh OOB callbacks) to detect the vulnerability. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads are present. The README describes the vulnerability and provides lab setup instructions. All observed behavior is consistent with a legitimate proof-of-concept for the stated CVE.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAMLMarkdown
Target softwareRoundcube Webmail
Attack typesCross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact consists of Nuclei templates that send crafted requests and use matchers to detect reflection or out-of-band callbacks. This behavior is consistent with a scanner, which checks for the presence of a vulnerability without exploiting it. The templates do not contain code to open emails in a browser, trigger JavaScript execution, or perform any post-exploitation actions like stealing emails.

CVE-2024-42009-OOB & Interactsh.yaml:16-19CVE-2024-42009.yaml:8-10README.md:23-25

Requirements

  • A target running a vulnerable version of Roundcube Webmail (<= 1.6.7 or <= 1.5.7).README.md:16
  • For OOB template, an Interactsh server or equivalent out-of-band callback listener must be configured.CVE-2024-42009-OOB & Interactsh.yaml:12-13

Observed behavior

  • Sends HTTP GET requests to Roundcube endpoints (root, compose, show) with injected XSS payloads and unique markers.CVE-2024-42009-OOB & Interactsh.yaml:59-60CVE-2024-42009.yaml:57
  • Checks HTTP responses for the presence of injected markers, Roundcube session cookies, or version strings to determine if the target is vulnerable.CVE-2024-42009.yaml:58-70CVE-2024-42009-OOB & Interactsh.yaml:64-75
  • Uses out-of-band (OOB) matchers to detect DNS or HTTP callbacks to an Interactsh server, indicating potential JavaScript execution.CVE-2024-42009-OOB & Interactsh.yaml:66-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Interactsh Url
Payload withheldNuclei placeholder for Out-of-Band interaction testing; used to confirm JavaScript execution in a controlled lab environment.CVE-2024-42009-OOB & Interactsh.yaml:40CVE-2024-42009-OOB & Interactsh.yaml:59CVE-2024-42009-OOB & Interactsh.yaml:80
Xss Payload
Payload withheldCrafted XSS payload used in the non-OOB template to trigger JavaScript execution in the vulnerable Roundcube endpoint.CVE-2024-42009.yaml:35
Google Drive Link
Payload withheldLink to a video demonstration of the exploit chain; the content of the video is not included in the evidence and cannot be reviewed.README.md:71
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. Four non-text media files and four unclassified files are present but not analyzed.
  • The analysis is based solely on the provided text content; the actual behavior of the templates when executed by a Nuclei engine is not observed.
  • Four non-text media files (e.g., Images/ screenshots, docker-compose.yml) totaling 763,427 bytes were not analyzed; their content could contain additional information not reflected in this review.
  • The video demonstration linked in the README (Google Drive) was not reviewed; its content is unknown.
  • Four text files (totaling 31,178 bytes) were omitted from the evidence packet and not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubZaidArif47/CVE-2024-42009Repository PoCby ZaidArif471Exploit4 files

193.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Docker-based Proof-of-Concept for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail. The README provides instructions to set up a vulnerable lab and send a crafted email that triggers JavaScript execution when a victim opens it.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a Proof-of-Concept for CVE-2024-42009, a stored XSS vulnerability in Roundcube. The README provides setup instructions using Docker, user creation commands, and a swaks command to send a crafted email that triggers an alert(1) in the victim's browser. No backdoor, concealed executable behavior, or operator-directed harm is present in the reviewed text. The artifact contains no executable source code; the only text file is the README, and the analysis scope confirms no executable source was identified.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesMarkdownShell
Target softwareRoundcube Webmail
Attack typesCross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The README explicitly describes itself as a 'working Proof-of-Concept (PoC)' and provides a complete, step-by-step guide to set up a vulnerable environment and execute an attack that triggers JavaScript execution in a victim's browser. The provided swaks command includes a crafted payload designed to exploit the vulnerability, which is the defining characteristic of an exploit.

README.md:5README.md:75-83

Requirements

  • A running Roundcube instance with vulnerable version (≤ 1.5.7 or ≤ 1.6.7) and configured mail server.README.md:13-14
  • An attacker must be able to send an email to a victim user on the target Roundcube instance.README.md:75-83
  • The victim user must open the malicious email in the Roundcube web interface.README.md:90-92

Observed behavior

  • Sets up a vulnerable Roundcube lab environment using Docker.README.md:30-45
  • Creates test user accounts (attacker and victim) on the mail server.README.md:51-56
  • Sends a malicious HTML email containing a crafted body tag with an 'onanimationstart' event handler to the victim.README.md:75-83
  • When the victim opens the email in Roundcube, the injected JavaScript executes, demonstrated by an alert popup.README.md:90-92
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
Payload withheldThe README instructs the user to send this HTML body via swaks to trigger an XSS alert in the victim's Roundcube instance. This is the expected PoC behavior for the stated CVE.README.md:83
Docker Setup Commands
Payload withheldStandard Docker commands to set up a local test environment. No hidden or malicious actions are indicated.README.md:44-55
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the README.md file. The actual exploit payload, Docker configuration, and any other scripts are not included in the provided text evidence.
  • The evidence does not include the source code of the vulnerable Roundcube application or the specific sanitization logic that is bypassed.
  • The screenshots referenced in the README are not provided, so the visual proof of exploitation cannot be verified.
  • Only the README.md file was provided as readable text; 3 other files (including 2 non-text media files and 1 unclassified file) were not analyzed. The analysis scope reports no executable source code identified, but the complete artifact coverage is incomplete.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubsegunakinsoyinu/CVE-2024-42009-roundcube-xssRepository PoCby segunakinsoyinu0Exploit4 files

12.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a functional exploit for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail. It includes a Python script (exploit.py) that constructs a malicious HTML email containing a CSS animation-based XSS payload and delivers it via unauthenticated SMTP. The payload, upon the victim opening the email, exfiltrates the victim's entire inbox to an attacker-controlled HTTP listener (listener.py, not included in the text evidence but described).

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and an exploit script for CVE-2024-42009, a stored XSS vulnerability in Roundcube. The exploit script constructs a malicious HTML email body containing a CSS animation-based XSS payload that exfiltrates the victim's inbox to an attacker-controlled HTTP listener. The behavior is consistent with the described vulnerability and does not exhibit any concealed, deceptive, or unrelated backdoor functionality targeting the person running the PoC.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonHTMLJavaScript
Target softwareRoundcube Webmail
Attack typesStored XSSData Exfiltration
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, executable script (exploit.py) that actively delivers a malicious payload to exploit a vulnerability, as opposed to merely detecting it. The script's primary function is to construct and send an XSS payload to exfiltrate data, which is the definition of an exploit.

exploit.py:1-99README.md:1

Requirements

  • Target must be running Roundcube Webmail version ≤ 1.6.6.README.md:13
  • Target SMTP server must allow unauthenticated relay on port 25.README.md:67
  • Attacker must run an HTTP listener to receive exfiltrated data.README.md:73-77

Observed behavior

  • Constructs an HTML email body with a malformed <body> tag containing a CSS animation event handler (onanimationstart) that executes a base64-encoded JavaScript payload.exploit.py:52-55
  • Connects to a target SMTP server on port 25 and sends the crafted email without authentication.exploit.py:68-72
  • The JavaScript payload, when executed in the victim's browser, iterates through inbox UIDs, fetches each email's content via Roundcube's internal API, and sends the collected data as a JSON POST request to an attacker-controlled server.exploit.py:39-48
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exfiltration Endpoint
Payload withheldThe JavaScript payload in the exploit sends exfiltrated email data to an attacker-specified HTTP listener. This is the intended exploit behavior for CVE-2024-42009 and is not a backdoor against the PoC operator.exploit.py:45-47
Payload Obfuscation
Payload withheldThe exploit script base64-encodes the JavaScript payload before embedding it in the HTML email. This is a standard technique to avoid character escaping issues in the injection vector and does not constitute concealment of backdoor behavior.exploit.py:50
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the content of listener.py, which is described as a required component for the full attack chain.
  • The evidence packet does not include the content of payload.html, which is described as a standalone payload file.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness is not verified.
  • Two files from the repository (listener.py and payload.html) were not included in the text evidence. Their content was not reviewed, but the README describes them as a CORS-capable HTTP server and a standalone XSS payload, respectively, which is consistent with the exploit's stated purpose.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub0xbassiouny1337/CVE-2024-42009Repository PoCby 0xbassiouny13374Not analyzed3 files

7.3 KiB

GitHub
PoC details
GitHubBhanunamikaze/CVE-2024-42009Repository PoCby Bhanunamikaze1Not analyzed3 files

7.1 KiB

GitHub
PoC details
GitHubDaniTheHack3r/CVE-2024-42009-PoCRepository PoCby DaniTheHack3r7Not analyzed4 files

17.0 KiB

GitHub
PoC details
GitHubFoxer131/CVE-2024-42008-9-exploitRepository PoCby Foxer1310Not analyzed3 files

1.9 KiB · linked to 2 vulnerabilities

GitHub
PoC details

Docker lab environments

2
GitHub

docker-compose.yml

ZaidArif47/CVE-2024-42009Created Vuln labCVE-2024-42009Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with a mail server (docker-mailserver) and a Roundcube webmail instance (version 1.6.7-apache) connected via a bridge network. The README describes it as a Proof-of-Concept for CVE-2024-42009, a stored XSS vulnerability in Roundcube.

docker-compose.yml:1-64README.md:1-8

Lab assessment

Vulnerability lab

The README explicitly states the repository demonstrates a PoC for CVE-2024-42009, a stored XSS in Roundcube. The Compose file sets up a mail server and a vulnerable Roundcube version (1.6.7) with configuration for local testing, matching the described vulnerability reproduction environment.

README.md:1-8docker-compose.yml:1-64
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mailserver

SMTP/IMAP mail server

Uses docker-mailserver:latest image. Exposes SMTP (2525), IMAP (143), Submission (587), and IMAPS (993) ports. Configured with permissive network settings (POSTFIX_MYNETWORKS=0.0.0.0/0) and SYS_PTRACE capability. Mounts local directories for mail data, state, logs, and config.

docker-compose.yml:3-33

roundcube

vulnerable webmail client

Uses roundcube/roundcubemail:1.6.7-apache image, which is within the affected version range per README. Exposes port 8080 for HTTP access. Configured to connect to the mailserver service for IMAP and SMTP. Mounts local directories for config and SQLite database.

docker-compose.yml:35-58README.md:11-13
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-42009

Supported by supplied evidence

The README describes the vulnerability as a stored XSS in Roundcube caused by improper HTML sanitization and unsafe attribute reprocessing, affecting versions ≤1.6.7. The Compose file uses roundcube/roundcubemail:1.6.7-apache, which falls within the affected range. The provided exploitation steps use a crafted email body that matches the described attribute injection technique.

README.md:1-8README.md:11-13README.md:15-22docker-compose.yml:36
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:25-30
  • Clone the repository and start the lab with 'docker compose up -d'.README.md:25-30
  • Create test users (attacker and victim) using 'docker exec mailserver setup email add'.README.md:32-36
  • Access Roundcube at http://localhost:8080 with the provided credentials.README.md:38-46
  • Use swaks tool to send a malicious email from attacker to victim.README.md:48-56

Evidence-described exercise path

  1. Start the Docker Compose environment.README.md:28-30
  2. Create attacker and victim mail accounts.README.md:32-36
  3. Log into Roundcube as the victim.README.md:38-46
  4. Send a crafted HTML email from attacker to victim using swaks.README.md:48-56
  5. Open the malicious email in the victim's Roundcube inbox to trigger the XSS.README.md:58-62
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. All visible behavior (port mappings, bind mounts, SYS_PTRACE capability, permissive network config) is consistent with setting up a local mail server and webmail client for testing the described XSS. No evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the lab target.

docker-compose.yml:1-64README.md:1-123
Review boundaries

What the analysis did not establish

  • Two binary screenshot files (swaks_PoC.png, XSS_PoC.png) are uninspected; their content cannot be verified.
  • The docker-mailserver image uses the 'latest' tag, so the exact version is not pinned.
  • The Compose file mounts host directories (mail-data, mail-state, mail-logs, config, roundcube-config, roundcube-db) which could be used to persist data beyond the container lifecycle, but this is typical for mail server state.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 2 binary files not inspected

GitHub

docker-compose.yaml

Shubhankargupta691/CVE-2024-42009Created Vuln labCVE-2024-42009Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a Roundcube Webmail instance (version 1.6.7-fpm) with an Nginx reverse proxy, intended as a lab to demonstrate CVE-2024-42009, a reflected XSS vulnerability.

docker-compose.yaml:1-28README.md:1-129

Lab assessment

Vulnerability lab

The README explicitly states the repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009, a critical reflected XSS vulnerability in Roundcube Webmail. The Docker Compose file sets up a vulnerable Roundcube instance (version 1.6.7-fpm) and an Nginx proxy, matching the lab setup described in the README.

README.md:3-7docker-compose.yaml:4-5
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

roundcube

vulnerable web application target

Roundcube Webmail version 1.6.7-fpm, configured with SQLite database and Gmail IMAP/SMTP settings. It is the target of the CVE-2024-42009 XSS vulnerability. The service mounts a named volume 'roundcube_data' at /var/www/html.

docker-compose.yaml:4-15

nginx

reverse proxyweb server

Nginx latest image acting as a reverse proxy for the Roundcube FPM service. It exposes port 8080 on the host, mounts the same 'roundcube_data' volume, and uses a custom nginx.conf to pass PHP requests to the roundcube service on port 9000.

docker-compose.yaml:17-24nginx.conf:1-18
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-42009

Supported by supplied evidence

The README explicitly identifies the repository as a PoC for CVE-2024-42009, describes the vulnerability in Roundcube's message_body() function, and the Docker Compose file deploys a vulnerable Roundcube version (1.6.7-fpm) which is within the affected range (≤ 1.6.7).

README.md:3-7README.md:15-19docker-compose.yaml:4-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab environment.README.md:37-40
  • The lab expects the user to send a crafted email containing a malicious HTML payload to the Roundcube instance, which requires an SMTP server or MailHog (mentioned in README but not included in the provided compose file).README.md:27-30README.md:37-40
  • An Interactsh or similar OOB listener is needed to receive callbacks confirming XSS execution.README.md:23-30

Evidence-described exercise path

  1. Clone the repository and start the lab environment using 'docker compose up -d'.README.md:37-40
  2. Access the Roundcube UI at http://localhost:8080 and log in (the README warns against using a real Google account).README.md:42-44
  3. Send a crafted email containing an XSS payload (e.g., using <body onanimationstart=...>) to the Roundcube instance.README.md:27-30README.md:77-95
  4. Open the malicious email in the Roundcube UI to trigger the XSS.README.md:27-30
  5. Confirm the vulnerability by observing a DNS or HTTP callback to the Interactsh domain.README.md:27-30
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Docker Compose file defines a standard lab setup with a vulnerable Roundcube instance and an Nginx proxy. It does not include any privileged mode, host filesystem mounts beyond the lab's own nginx.conf, or commands that escape the container. The README explicitly states the PoC is for educational and authorized testing only. No hidden or unnecessary behavior targeting the host or external systems is visible.

docker-compose.yaml:1-28README.md:9
Review boundaries

What the analysis did not establish

  • The provided docker-compose.yaml does not include a MailHog or SMTP service, which the README mentions as part of the lab setup. This omission may affect the ability to send emails to the Roundcube instance without additional configuration.
  • The Nuclei templates and other repository files (e.g., CVE-2024-42009.yaml) are not included in the evidence packet, so their content and behavior cannot be assessed.
  • The README references a video demonstration and external PoC repositories, but these are not part of the supplied evidence.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Nuclei templates

1
ProjectDiscoveryCRITICALRoundcube Webmail - Cross-Site ScriptingCVSS 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Impact

Attackers can steal and send victim emails, leading to privacy breach and potential further exploitation.

Remediation

Update to the latest version of Roundcube, version 1.6.8 or later.

WeaknessesCWE-79
Authorsrxerium
Template tagscvecve2024roundcubexssvkevpassivekevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CPE: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Shodan: cpe:"cpe:2.3:a:roundcube:webmail"
FOFA: roundcube_sessid
https://github.com/roundcube/roundcubemail/releases https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8 https://nvd.nist.gov/vuln/detail/CVE-2024-42009

Source: ProjectDiscovery

References

7