CVE-2024-42008 PoC — Roundcube Webmail 安全漏洞

Source

https://github.com/Foxer131/CVE-2024-42008-9-exploit

Associated Vulnerability

Title: Roundcube Webmail 安全漏洞 (CVE-2024-42008)
Description:A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

Description

The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7

Readme

# CVE-2024-42008-9-exploit
The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7

Read more about these CVEs and how they can be exploited in the following link:
```
https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
```

The javascript code reads 20 emails in the victims inbox. So to get the response it is necessary to set up a listener on port 80.
The standard python http server won't work since it only admits GET requests, and in this case the script performs POST requests.

To fix this issue I suggest asking ChatGPT or Deepseek to make a script that admits POST requests.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →