CVE-2024-57004: Roundcube Webmail XSS Vulnerability

CVE-2024-57004 Overview

CVE-2024-57004 is a stored Cross-Site Scripting (XSS) vulnerability affecting Roundcube Webmail version 1.6.9. Authenticated users can upload a malicious file as an email attachment. The payload triggers when a recipient or the sender visits the SENT folder session, executing attacker-controlled script in the victim's browser context.

The flaw is classified under [CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)]. Successful exploitation can lead to session compromise, mailbox data theft, and further phishing pivots against Roundcube users.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in a victim's Roundcube session by delivering a crafted attachment, enabling account takeover and email exfiltration.

Affected Products

Roundcube Webmail 1.6.9
Deployments exposing the Roundcube interface to authenticated users
Shared hosting and enterprise mail platforms bundling Roundcube 1.6.9

Discovery Timeline

2025-02-03 - CVE-2024-57004 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-57004

Vulnerability Analysis

Roundcube Webmail 1.6.9 fails to properly neutralize script content associated with email attachments rendered in the SENT folder view. An authenticated user composes and sends a message with a specifically crafted attachment. When the SENT view renders metadata or a preview tied to that attachment, the browser interprets embedded HTML or script tags instead of treating them as inert text.

Because the malicious content is stored in the mailbox, the payload persists across sessions. Any user visiting the affected SENT session receives the script in their authenticated browser context. This grants the attacker the same privileges as the victim within the webmail application, including reading messages, sending mail on behalf of the user, and interacting with any connected plugins.

Root Cause

The root cause is insufficient output encoding of attachment-related fields rendered in the SENT folder. Basic XSS filtering [CWE-80] does not strip or escape all script-capable HTML constructs before the data reaches the DOM. Attachment names, MIME metadata, or preview content are trusted and inserted into the page without contextual sanitization.

Attack Vector

Exploitation requires an authenticated Roundcube account and user interaction to visit the SENT folder. The attack proceeds over the network against the webmail interface. A crafted attachment carries the payload, which the SENT view renders and executes. See the GitHub proof-of-concept for the reproduction steps published by the reporter.

The vulnerability manifests in attachment rendering within the SENT session view. Refer to the Roundcube 1.6.9 release notes for the affected code baseline.

Detection Methods for CVE-2024-57004

Indicators of Compromise

Email attachments with filenames containing HTML tags, angle brackets, or JavaScript event handlers such as onerror= or onload=.
Unexpected outbound requests from webmail user browsers to attacker-controlled domains shortly after opening the SENT folder.
New or modified Roundcube session identifiers correlated with reads of unusual sent messages.

Detection Strategies

Inspect stored mailbox data for attachment metadata containing <script>, <img, <svg, or inline event handlers.
Enable web server access logging for /roundcube/?_task=mail&_mbox=Sent requests and correlate with outbound browser traffic.
Deploy Content Security Policy (CSP) reporting to surface script execution attempts violating the webmail policy.

Monitoring Recommendations

Alert on anomalous mail-forwarding rule creation or bulk message reads initiated from browser sessions.
Monitor Roundcube application logs for authentication events immediately followed by attachment uploads with suspicious filenames.
Track EPSS trend data for CVE-2024-57004, currently 28.82% at the 97.952 percentile, which indicates elevated exploitation likelihood relative to peer CVEs.

How to Mitigate CVE-2024-57004

Immediate Actions Required

Upgrade Roundcube Webmail beyond version 1.6.9 once a fixed release is available from the vendor.
Restrict Roundcube access to authenticated internal users while the patch is being validated.
Enforce a strict Content Security Policy on the webmail virtual host to block inline script execution.

Patch Information

No vendor advisory or fixed version is listed in the referenced data for CVE-2024-57004. Track the Roundcube release page for a version superseding 1.6.9 that addresses the SENT folder attachment rendering issue.

Workarounds

Configure the webmail HTTP response headers to enforce Content-Security-Policy: default-src 'self'; script-src 'self' to limit script execution surfaces.
Disable HTML rendering for attachment previews and force plain-text display in the SENT folder view.
Instruct users to avoid opening the SENT folder until a fix is applied, and to report unexpected script or dialog prompts.

bash

# Configuration example: enforce CSP for Roundcube via Apache
<VirtualHost *:443>
    ServerName webmail.example.com
    DocumentRoot /var/www/roundcube

    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer"
</VirtualHost>