CVE-2023-43770
Published: 22 September 2023
Summary
CVE-2023-43770 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Roundcube Webmail. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Roundcube webmail before version 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 contains a cross-site scripting vulnerability tracked as CVE-2023-43770. The flaw stems from insufficient handling of crafted links inside text/plain email messages by the rcube_string_replacer.php component, which permits script injection when messages are rendered.
An unauthenticated remote attacker can exploit the issue by sending a malicious text/plain email containing specially formatted links. When a victim views the message in the affected Roundcube interface, the injected script executes in the user's browser context with the application's origin, enabling theft of session data or other actions permitted by the reflected XSS.
Upstream fixes are available via commits in the Roundcube repository, and administrators should upgrade to 1.4.14, 1.5.4, or 1.6.3. Debian LTS has published corresponding advisories directing users to apply the patched packages. The EPSS score remains elevated near its recorded peak of 0.81, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48147
Vulnerability details
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
- CWE(s)
- KEV Date Added
- 12 February 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of untrusted input (crafted links in text/plain messages) before rendering, directly blocking the XSS flaw in rcube_string_replacer.php.
Mandates timely identification and remediation of known flaws, directly addressed by upgrading Roundcube to 1.4.14/1.5.4/1.6.3 to correct the sanitization logic.
Requires filtering of output data to remove potentially malicious content before display in the webmail interface, mitigating the unsanitized links.