CVE-2024-37384: Roundcube Webmail XSS Vulnerability

CVE-2024-37384 Overview

CVE-2024-37384 is a stored cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.5.7 and 1.6.x before 1.6.7. The flaw resides in how the application handles list column values sourced from user preferences. An attacker who can influence a user's preferences can inject arbitrary HTML or JavaScript that executes in the victim's browser session. The vulnerability is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation. Debian Linux 10.0 is also listed among affected downstream distributions.

Critical Impact
Successful exploitation enables execution of attacker-controlled script in the context of the Roundcube webmail interface, leading to session compromise, mailbox access, and further account takeover.

Affected Products

Roundcube Webmail versions prior to 1.5.7
Roundcube Webmail 1.6.x versions prior to 1.6.7
Debian Linux 10.0 (Roundcube package)

Discovery Timeline

2024-06-07 - CVE-2024-37384 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37384

Vulnerability Analysis

Roundcube Webmail renders message list columns based on values retrieved from the _cols request parameter and user preferences. Prior to the fix, the application did not validate or sanitize these column identifiers before embedding them into generated HTML. An attacker able to set a crafted column value in a user's preferences, or trick a user into visiting a URL containing a malicious _cols value, causes the injected payload to render in the mail list view. Because the payload executes within the authenticated Roundcube origin, it can read mail contents, exfiltrate messages, and issue requests as the victim. The issue is stored XSS when persisted through preferences and reflected XSS via the _cols GET parameter.

Root Cause

The root cause is missing input validation in program/actions/mail/index.php and program/actions/mail/list.php. Column names retrieved from user-controllable sources were used directly when constructing message list markup. The fix adds a strict allowlist regex (/^[a-zA-Z_-]+$/) to reject any column identifier containing HTML metacharacters or scripting payloads.

Attack Vector

Exploitation requires user interaction: the victim must be authenticated and load the affected mail view. An attacker delivers a crafted link or persists a malicious column preference server-side. The scope-changed XSS then executes in the browser under the Roundcube session.

php

// Security patch in program/actions/mail/index.php
// Fix: sanity check on user-supplied column identifiers before rendering
foreach ($a_show_cols as $col) {
    // sanity check
    if (!preg_match('/^[a-zA-Z_-]+$/', $col)) {
        continue;
    }

    $label    = '';
    $sortable = false;
    $rel_col  = $col == 'date' && $sort_col == 'arrival' ? 'arrival' : $col;
}
// Source: https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7

php

// Security patch in program/actions/mail/list.php
// Fix: explicit retrieval and later validation of the _cols input
$rcmail        = rcmail::get_instance();
$save_arr      = [];
$dont_override = (array) $rcmail->config->get('dont_override');

$sort = rcube_utils::get_input_string('_sort', rcube_utils::INPUT_GET);
$cols = rcube_utils::get_input_string('_cols', rcube_utils::INPUT_GET);
$layout = rcube_utils::get_input_string('_layout', rcube_utils::INPUT_GET);

// is there a sort type for this request?
if ($sort && preg_match('/^[a-zA-Z_-]+$/', $sort)) {
    // yes, so set the sort vars
    list($sort_col, $sort_order) = explode('_', $sort);
}
// Source: https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7

Detection Methods for CVE-2024-37384

Indicators of Compromise

Roundcube HTTP requests containing a _cols parameter with characters outside [a-zA-Z_-], particularly <, >, ", or script.
User preference records with list_cols values containing HTML tags, event handlers, or JavaScript URIs.
Unexpected outbound requests from browser sessions accessing Roundcube (possible XSS-driven exfiltration).

Detection Strategies

Inspect web server access logs for mail?_cols= query strings containing encoded angle brackets or scripting keywords.
Query the Roundcube users and user_preferences tables for list_cols entries that fail an allowlist regex match.
Deploy web application firewall rules that flag or block requests to /mail/ endpoints with non-alphabetic characters in column parameters.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the Roundcube host to detect script-execution violations.
Alert on Roundcube session cookies being sent to unexpected external hosts.
Track authentication anomalies such as concurrent sessions or unusual mailbox access following a preference change.

How to Mitigate CVE-2024-37384

Immediate Actions Required

Upgrade Roundcube Webmail to 1.5.7, 1.6.7, or later on all affected hosts.
Debian administrators must apply the Roundcube package update announced in the Debian LTS Announcement.
Audit stored user preferences for malicious list_cols values and reset any that fail the allowlist check.
Invalidate active user sessions after patching to prevent reuse of tokens obtained via XSS.

Patch Information

The upstream fix is delivered in Roundcube Release 1.5.7 and Roundcube Release 1.6.7. The corresponding code change is available in the GitHub Commit Update, which adds regex validation on column identifiers in both program/actions/mail/index.php and program/actions/mail/list.php.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on the Roundcube origin.
Restrict who can modify user preferences and require re-authentication for preference changes.
Block _cols request values that do not match ^[a-zA-Z_-]+$ at the reverse proxy or WAF layer.

bash

# Example nginx WAF-style filter to reject malformed _cols parameters
if ($arg__cols ~* "[^a-zA-Z_-]") {
    return 400;
}