Roundcube Cross-Site Scripting

[aliveli365]

Examples page :
-- http://localhost.com/cpsess5903914110/3rdparty/roundcube/?_task=settings&_action=identities
- -ADD SIGNATURE HTML
-- Select source code
-- Payload is entered in the name field
-- saving and running
Payload :
--

Mail : cybersecurity@muslumdag.com

[alecpl]

It would be XSS if a 3rd party could do this. What payload? A <script> or something more sophisticated?

[aliveli365]

Check from here : https://cxsecurity.com/issue/WLB-2020010153

[alecpl]

So, this is <embed> with insecure src=data:image/svg+xm,...l. I confirm this in release-1.4, but not in git-master. I'll see if there's some easy fix for 1.4 possible.

As this works only with a content inserted by the user itself, I'm not even sure we can call it a security issue.

[alecpl]

It does not happen in the mail compose editor, probably because media plugin is enabled there. It looks that we could set invalid_elements: 'embed' to prevent that issue in the signature editor.

[aliveli365]

It's not too dangerous for you from now on, but no one knows what might happen. 😅
Just thought there might be benefit in reporting...

[alecpl]

Fixed.