This is a repository for hands-on practice of the CVE-2024-37383 vulnerability.

• Analysis Report: [ blog / pdf ]

CVE-2024-37383

Detail

• Name : Roundcube Webmail SVG Parsing XSS
• Target : Roundcube Webmail v1.5.7 or v1.6.x < v1.6.7
• CVSS Score : 6.1
• Published Date : 2024-06-07

When Roundcube processes an svg tag, attribute parsing is not performed correctly, so if an attacker inserts an HTML payload containing a manipulated <svg> tag into an email, arbitrary scripts are executed in the browser.

Exploit

git clone https://github.com/hyungin0505/CVE-2024-37383_PoC.git
cd CVE-2024-37383_PoC

docker compose up -d

After completing the environment setup, you can access the Roundcube webmail server at localhost:8080/.
In the docker-compose.yml file, the default user account is set to [email protected]:1234.

python3 send.py

When you send an SMTP email containing an HTML payload using send.py, you can check the email in Roundcube's inbox.

Screenshot