Previously unknown XSS in Roundcube let Winter Vivern steal government emails.

“In summary, by sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user’s browser window,” ESET researcher Matthieu Faou wrote. “No manual interaction other than viewing the message in a web browser is required.”

The attacks began on October 11, and ESET detected them a day later. ESET reported the zero-day vulnerability to Roundcube developers on the same day, and they issued a patch on October 14. The vulnerability is tracked as CVE-2023-5631 and affects Roundcube versions 1.6.x before 1.6.4, 1.5.x before 1.5.5, and 1.4.x before 1.4.15.

  • MusketeerXEnglish
    8•1 year ago

    It’s things like this that make me glad that my email service defaults to not loading any images/links/html. There’s a small button at the top to load them if I want.

  • AutoTL;DRBEnglish
    5•1 year ago

    This is the best summary I could come up with:

    A relentless team of pro-Russia hackers has been exploiting a zero-day vulnerability in widely used webmail software in attacks targeting governmental entities and a think tank, all in Europe, researchers from security firm ESET said on Wednesday.

    The previously unknown vulnerability resulted from a critical cross-site scripting error in Roundcube, a server application used by more than 1,000 webmail services and millions of their end users.

    Members of a pro-Russia and Belarus hacking group tracked as Winter Vivern used the XSS bug to inject JavaScript into the Roundcube server application.

    “In summary, by sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user’s browser window,” ESET researcher Matthieu Faou wrote.

    “This actor has been tenacious in its targeting of American and European officials as well as military and diplomatic personnel in Europe,” a threat researcher from security firm Proofpoint said in March when disclosing the attacks exploiting the Zimbra vulnerability.

    Since the tag contained an intentional error, the malicious command was invoked, and the XSS bug ensured that Roundcube executed the resulting JavaScript.

    The original article contains 456 words, the summary contains 184 words. Saved 60%. I’m a bot and I’m open source!