Threat actors are actively weaponizing CVE-2024-37383 (CVSS 6.1), a stored cross-site scripting vulnerability impacting Roundcube Webmail versions prior to 1.5.7 and 1.6.7. The vulnerability resides in Roundcube’s HTML sanitization routines handling Scalable Vector Graphics (SVG) elements. Specifically, the parser fails to properly sanitize the href attribute inside <animate> tags when attackers inject trailing whitespace into the attribute name (e.g., attributeName="href "). This syntax evasion allows arbitrary JavaScript payloads embedded in the attribute value to bypass DOMPurify filters and execute automatically within the authenticated browser session when a recipient opens a weaponized email.

Threat intelligence from Positive Technologies revealed that attackers targeted government organizations across the Commonwealth of Independent States (CIS) using seemingly empty emails with hidden base64-encoded XSS payloads. Once triggered, the script downloads a decoy Word document, dynamically injects fraudulent credential harvesting forms into the webmail interface, and leverages Roundcube’s native ManageSieve plugin API to silently query and exfiltrate victim emails to external infrastructure. Roundcube remediated the parsing flaw in versions 1.5.7 and 1.6.7, and CISA added CVE-2024-37383 to its Known Exploited Vulnerabilities catalog.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Malformed SVG attribute parsing circumvents client-side sanitizers, converting standard email rendering into a zero-interaction code execution primitive that executes in the security context of an authenticated user session without triggering endpoint defenses.
• Bullet 2 — Strategic & Defender Imperative: Administrators must urgently upgrade exposed Roundcube instances to version 1.5.7/1.6.7 or newer, enforce strict Content Security Policy headers preventing unauthorized script execution, and audit server-side Sieve filter rules for suspicious mail-forwarding directives.