A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0328-1 advisory.

    Update to 1.6.8     This is a security update to the stable version 1.6 of Roundcube Webmail.
    It provides fixes to recently reported security vulnerabilities:

      * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
      * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
      * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

      CHANGELOG

      * Managesieve: Protect special scripts in managesieve_kolab_master mode
      * Fix newmail_notifier notification focus in Chrome (#9467)
      * Fix fatal error when parsing some TNEF attachments (#9462)
      * Fix double scrollbar when composing a mail with many plain text lines (#7760)
      * Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
      * Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
      * Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
      * Fix bug where 'with attachment' filter could fail on some fts engines (#9514)
      * Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
      * Fix bug where a long subject title could not be displayed in some cases (#9416)
      * Fix infinite loop when parsing malformed Sieve script (#9562)
      * Fix bug where imap_conn_option's 'socket' was ignored (#9566)
      * Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
      * Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
      * Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b60eb661a4 advisory.

    **Version 1.6.8**

    - Managesieve: Protect special scripts in managesieve_kolab_master mode
    - Fix newmail_notifier notification focus in Chrome (#9467)
    - Fix fatal error when parsing some TNEF attachments (#9462)
    - Fix double scrollbar when composing a mail with many plain text lines (#7760)
    - Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
    - Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
    - Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
    - Fix bug where with attachment filter could fail on some fts engines (#9514)
    - Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
    - Fix bug where a long subject title could not be displayed in some cases (#9416)
    - Fix infinite loop when parsing malformed Sieve script (#9562)
    - Fix bug where imap_conn_option's 'socket' was ignored (#9566)
    - Fix XSS vulnerability in post-processing of sanitized HTML content **CVE-2024-42009**
    - Fix XSS vulnerability in serving of attachments other than HTML or SVG **CVE-2024-42008**
    - Fix information leak (access to remote content) via insufficient CSS filtering **CVE-2024-42010**




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2e908e829a advisory.

    **Version 1.6.8**

    - Managesieve: Protect special scripts in managesieve_kolab_master mode
    - Fix newmail_notifier notification focus in Chrome (#9467)
    - Fix fatal error when parsing some TNEF attachments (#9462)
    - Fix double scrollbar when composing a mail with many plain text lines (#7760)
    - Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
    - Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
    - Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
    - Fix bug where with attachment filter could fail on some fts engines (#9514)
    - Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
    - Fix bug where a long subject title could not be displayed in some cases (#9416)
    - Fix infinite loop when parsing malformed Sieve script (#9562)
    - Fix bug where imap_conn_option's 'socket' was ignored (#9566)
    - Fix XSS vulnerability in post-processing of sanitized HTML content **CVE-2024-42009**
    - Fix XSS vulnerability in serving of attachments other than HTML or SVG **CVE-2024-42008**
    - Fix information leak (access to remote content) via insufficient CSS filtering **CVE-2024-42010**




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5776cc4f-5717-11ef-b611-84a93843eb75 advisory.

    The Roundcube project reports:
    XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]     XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]     information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web server is running Roundcube Webmail version 1.5.x prior to 1.5.8 or 1.6.x prior to 1.6.8. It is, therefore, affected by multiple vulnerabilities.

  - A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x   through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail   attachment served with a dangerous Content-Type header. (CVE-2024-42008)

  - A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote   attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization   issue in message_body() in program/actions/mail/show.php. (CVE-2024-42009)

  - mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a insufficiently filters   Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to   obtain sensitive information. (CVE-2024-42010)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5743 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5743-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 08, 2024                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : roundcube     CVE ID         : CVE-2024-42008 CVE-2024-42009 CVE-2024-42010

    Multiple cross-site scripting vulnerabilities were discovered in     RoundCube webmail.

    For the stable distribution (bookworm), these problems have been fixed in     version 1.6.5+dfsg-1+deb12u3.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208677	openSUSE 15 Security Update : roundcubemail (openSUSE-SU-2024:0328-1)	Nessus	SuSE Local Security Checks	critical
205626	Fedora 39 : roundcubemail (2024-b60eb661a4)	Nessus	Fedora Local Security Checks	critical
205574	Fedora 40 : roundcubemail (2024-2e908e829a)	Nessus	Fedora Local Security Checks	critical
205349	FreeBSD : Roundcube -- Multiple vulnerabilities (5776cc4f-5717-11ef-b611-84a93843eb75)	Nessus	FreeBSD Local Security Checks	critical
205297	Roundcube Webmail 1.5.x < 1.5.8 / 1.6.x < 1.6.8 Multiple Vulnerabilities	Nessus	CGI abuses	critical
205191	Debian dsa-5743 : roundcube - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2024-42008

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical