Roundcube Webmail XSS Leading to Account Takeover (CVE-2024-37383)

CVE-2024-37383 is a stored cross-site scripting flaw in Roundcube webmail via crafted SVG attachments. When an admin or user opens the message, attacker JavaScript can steal session cookies and hijack mail accounts.

Affected Roundcube

• Roundcube before 1.5.7
• Roundcube before 1.6.7
• Self-hosted webmail on Linux + Apache/Nginx + PHP

Check version

grep -R 'RCMAIL_VERSION' /var/www/roundcube/index.php
dpkg -l roundcube 2>/dev/null || rpm -q roundcube

Fix

• Upgrade Roundcube to patched release
• Enable strict Content-Security-Policy headers on webmail vhost
• Review mail logs for suspicious SVG attachments
• Force password reset for users who opened unknown HTML/SVG mail during exposure window

Often chained with phishing to steal corporate email and reset passwords elsewhere.