Roundcube Webmail <= 1.5.7 and 1.6.x <= 1.6.7 - Cross-Site Scripting via Desanitization in message_body()
Title source: llmExploitation Summary
CVE-2024-42009 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 9, 2025. EIP tracks 6 public exploits from researchers including DaniTheHack3r, 0xbassiouny1337, ZaidArif47. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail. The exploit demonstrates how an attacker can inject malicious JavaScript into an email message to exfiltrate email content from a victim's inbox.
Description
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Exploits (6)
This repository contains a functional proof-of-concept exploit for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail. The exploit demonstrates how an attacker can inject malicious JavaScript into an email message to exfiltrate email content from a victim's inbox.
This repository contains a functional Python exploit for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail 1.6.7. The exploit injects a malicious payload via a contact form, which exfiltrates email content to an attacker-controlled server.
This repository provides a functional Docker-based PoC for CVE-2024-42009, a stored XSS vulnerability in Roundcube Webmail. It includes a pre-configured environment and a crafted email payload to demonstrate the exploit.
This repository contains a functional PoC for CVE-2024-42009, demonstrating an XSS vulnerability in a webmail application to exfiltrate email content via a crafted payload and HTTP listener.
The repository contains functional Nuclei templates for detecting and exploiting CVE-2024-42009, a reflected XSS vulnerability in Roundcube Webmail. The templates include OOB (Out-of-Band) and direct injection methods to verify the vulnerability.
This repository contains a functional exploit for CVE-2024-42008 and CVE-2024-42009, targeting Roundcube 1.6.7. The exploit leverages XSS to exfiltrate email contents via a crafted payload delivered through a contact form.
Nuclei Templates (1)
cpe:"cpe:2.3:a:roundcube:webmail"
roundcube_sessid
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N