Search: CVE-2024-42009

CVE-2024-42009 is a critical cross-site scripting (XSS) vulnerability in RoundCube Webmail. It allows a remote attacker to exploit a desanitization issue in the message_body() function, enabling theft and unauthorized sending of emails via crafted messages. This vulnerability has been exploited in the wild.

The UNC1151 threat actor is conducting a spearphishing campaign exploiting a critical vulnerability (CVE-2024-42009) in the Roundcube webmail client. Malicious JavaScript embedded in phishing emails installs a stealthy Service Worker in victims' browsers upon opening the email, intercepting login credentials and exfiltrating them without further user interaction. A second vulnerability (CVE-2025-49113) may be chained to increase persistence and impact. Stolen credentials enable attackers to access mailboxes, harvest address books, and propagate phishing internally, facilitating lateral movement. The campaign primarily targets Polish organizations but also threatens neighboring Central European countries with significant Roundcube deployments. Organizations are urged to patch vulnerabilities, monitor for unusual Service Worker activity, enforce multi-factor authentication, and enhance email filtering to mitigate risks.

Campaign#roundcube#spearphishingPoland+5