关联漏洞
标题：
Roundcube Webmail 安全漏洞
(CVE-2024-42008)
描述：Roundcube Webmail是一款基于浏览器的开源IMAP客户端，它支持地址薄管理、信息搜索、拼写检查等。 Roundcube Webmail 1.5.7及之前版本和1.6.8之前的1.6.x版本存在安全漏洞，该漏洞源于存在跨站脚本漏洞，远程攻击者可以通过带有危险Content-Type标头的恶意电子邮件附件窃取和发送受害者的电子邮件。
描述
The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7
介绍
# CVE-2024-42008-9-exploit
The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7
Read more about these CVEs and how they can be exploited in the following link:
```
https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
```
The javascript code reads 20 emails in the victims inbox. So to get the response it is necessary to set up a listener on port 80.
The standard python http server won't work since it only admits GET requests, and in this case the script performs POST requests.
To fix this issue I suggest asking ChatGPT or Deepseek to make a script that admits POST requests.
文件快照
[4.0K] /data/pocs/8c2b3af38d5a122456252c69d00f4df28c463955
├── [ 484] exploit.js
├── [ 750] README.md
└── [ 755] script.py
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。