CVE-2025-40632: Icewarp Mail Server XSS Vulnerability

CVE-2025-40632 Overview

CVE-2025-40632 is a cross-site scripting (XSS) vulnerability in Icewarp Mail Server version 11.4.0. The flaw resides in how the application processes the lastLogin cookie value. An attacker who can modify this cookie can inject arbitrary JavaScript that executes in the victim's browser when the affected page renders. The issue is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Spanish National Cybersecurity Institute (INCIBE-CERT) published an advisory covering this and related issues in the product.

Critical Impact
An attacker with adjacent network access can execute arbitrary JavaScript in a user's authenticated session, enabling session data theft, webmail content disclosure, and unauthorized actions within the mail client context.

Affected Products

Icewarp Mail Server 11.4.0
Deployments matching CPE cpe:2.3:a:icewarp:mail_server:11.4.0
Webmail interfaces exposing the lastLogin cookie handling

Discovery Timeline

2025-05-16 - CVE-2025-40632 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40632

Vulnerability Analysis

The vulnerability is a stored/reflected cross-site scripting flaw tied to the handling of a client-controllable cookie. Icewarp Mail Server 11.4.0 reads the lastLogin cookie and writes its value into rendered HTML without sufficient output encoding. When an attacker sets the cookie to a JavaScript payload, the browser executes the code inside the user's authenticated webmail session.

Successful exploitation grants the attacker script execution in the origin of the mail server web interface. This includes access to the Document Object Model (DOM), cookies not marked HttpOnly, and any session state exposed to client script. Attackers can pivot to actions such as reading mail content, exfiltrating tokens, or issuing requests on behalf of the user.

The EPSS probability for this issue is 0.183%, indicating a low observed likelihood of exploitation at scale, though targeted use against known Icewarp deployments remains realistic.

Root Cause

The root cause is improper neutralization of user-controlled input during HTML generation (CWE-79). The application treats the lastLogin cookie value as trusted display data and does not HTML-encode or otherwise sanitize the value before writing it into the response body. Because cookies are attacker-writable through JavaScript in the same origin, network interception, or browser-based attacks, this trust boundary is incorrect.

Attack Vector

Exploitation requires the attacker to influence the value of the lastLogin cookie in the victim's browser and induce the victim to load the vulnerable page. Delivery paths include a chained XSS on the same origin, a man-in-the-middle position on an adjacent network segment when transport protections are weak, or a malicious link that sets the cookie through a related endpoint. The payload executes on next page render, requiring user interaction to visit the affected webmail view.

No verified public proof-of-concept code is available. See the INCIBE CERT Security Notice for the vendor-adjacent advisory covering this vulnerability and other issues in Icewarp Mail Server.

Detection Methods for CVE-2025-40632

Indicators of Compromise

lastLogin cookie values containing HTML tags, <script> fragments, javascript: URIs, or event handler attributes such as onerror= or onload=.
Web server access logs showing Cookie: headers with URL-encoded angle brackets (%3C, %3E) or encoded script keywords.
Unexpected outbound requests from webmail sessions to attacker-controlled hosts shortly after user login.

Detection Strategies

Inspect HTTP request headers at the reverse proxy or WAF for cookie values that contain HTML metacharacters or JavaScript syntax.
Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from the Icewarp webmail origin.
Correlate authenticated mail sessions with anomalous DOM-initiated network calls using browser telemetry or endpoint detection tooling.

Monitoring Recommendations

Enable verbose logging on the Icewarp web front end and forward logs to a centralized SIEM for cookie-value inspection.
Alert on repeated Set-Cookie or Cookie header anomalies scoped to the lastLogin name.
Track user-agent and source IP patterns for accounts that trigger CSP violations on the webmail application.

How to Mitigate CVE-2025-40632

Immediate Actions Required

Upgrade Icewarp Mail Server to a version later than 11.4.0 once a fixed release is available from the vendor.
Restrict webmail access to trusted networks or via VPN until a patched version is deployed.
Enforce HTTPS with HSTS to reduce cookie-tampering opportunities on adjacent networks.

Patch Information

No vendor advisory URL or fixed version is listed in the NVD entry at time of publication. Administrators should consult Icewarp directly and monitor the INCIBE CERT Security Notice for updates on remediation and patched releases.

Workarounds

Configure a web application firewall rule that rejects requests where the lastLogin cookie contains <, >, or javascript: sequences.
Set a strict Content-Security-Policy header on the webmail response to block inline script execution and untrusted script sources.
Mark session cookies as HttpOnly, Secure, and SameSite=Strict to limit the impact of any injected script.

bash

# Example NGINX reverse proxy rule to strip malicious lastLogin cookie values
map $http_cookie $sanitized_cookie {
    "~*lastLogin=[^;]*[<>\"']"  "";
    default                       $http_cookie;
}

server {
    listen 443 ssl;
    server_name mail.example.com;

    location / {
        proxy_set_header Cookie $sanitized_cookie;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
        proxy_pass http://icewarp_backend;
    }
}