CVE-2024-42009

This vulnerability lets an attacker hide malicious instructions inside an email. If a user who’s already logged into Roundcube opens that email, the attacker’s code can run in the browser—allowing them to take over the webmail session and send emails as the victim.

This matters if you run RoundCube Webmail and your version is in the affected range (1.5.7 and 1.6.x through 1.6.7). Attacks don’t work against people who aren’t already logged in to Roundcube, but the victim does need to open the attacker’s email in the Roundcube inbox.

Because CISA KEV confirms active exploitation, treat this as a risk wherever the webmail is reachable and users receive attacker-controlled messages.

This is RED because it is confirmed exploited in the real world (listed in CISA KEV, with reported incidents). The attacker can steal a logged-in user’s session and send emails on their behalf, so successful phishing can directly impact accounts and communications.

Confirm exposure

• Identify your exact RoundCube Webmail version.
• You are exposed if you use:
  • RoundCube Webmail up to 1.5.7, or
  • RoundCube Webmail 1.6.x through 1.6.7.
• Also confirm the webmail is in use by staff who are likely to open external emails while logged in.

Patch / upgrade (fixed versions)

• Upgrade to 1.5.8 (for the 1.5 branch) or 1.6.8 (for the 1.6 branch), using the vendor’s security updates.
• Vendor guidance is linked in the patch findings.

Validate after upgrade

• Re-check the installed RoundCube Webmail version after deployment.
• Confirm any web application caches or deployments are serving the updated version.

Temporary workaround if you can’t patch right away

• Restrict or pause access to the affected Roundcube instance until patched.
• Increase email filtering for suspicious messages (especially messages that are unexpected, contain unusual content, or arrive from newly seen senders). This reduces the chance users will open the crafted message that triggers the browser-based attack.

What to monitor

• Signs of unauthorized actions:
  • emails sent that you don’t recognize,
  • unusual outbound traffic from webmail accounts,
  • user complaints that they “opened” an email but didn’t expect any follow-on activity.
• Account/session anomalies consistent with session theft (for example, repeated login/session events around the time of suspicious emails).

CISA timeline

• CISA KEV remediation due date: 2025-06-30.

Severity is critical (reported as CVSS 9.3). The weakness is Cross-Site Scripting (CWE-79) in Roundcube’s handling of message content: a crafted email can abuse a sanitization/desanitization issue related to message_body() so that malicious browser-executable content is triggered when the victim opens the message in Roundcube.

Key exploitation details from findings:

• Authentication: no attacker authentication needed to send the malicious email.
• Preconditions: the victim must already be logged into Roundcube.
• User interaction: the victim must open the crafted email in Roundcube.
• Impact mechanism: attackers can steal the victim’s session and send emails on the victim’s behalf.

Exploitation status:

• CISA KEV: YES (added 2025-06-09) with a remediation due date of 2025-06-30.
• News confirms real-world exploitation and attacker behavior consistent with session theft and persistence (e.g., web shell deployment).

Exploit maturity:

• Confirmed exploited in the wild per KEV/news, meaning this is not theoretical.