Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability via Plain Text Email Link Processing (CVE-2023-43770)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-43770) is a stored/reflected Cross-Site Scripting (XSS) flaw within the link parsing and rendering engine of Roundcube Webmail. To display plain text (text/plain) emails safely, Roundcube utilizes the program/lib/Roundcube/rcube_string_replacer.php component to convert plain text URLs into clickable HTML anchor (<a>) tags. Due to insufficient input sanitization and improper escaping within this component, specially crafted malicious links can bypass the filter and render executable scripts directly in the user's browser.

2. Exploitation Mechanics & Attack Scenario

An attacker crafts a plain text email containing a malicious payload embedded within a URL structure designed to exploit browser DOM parsing behaviors. When the email is delivered, Roundcube's backend processes the message and invokes rcube_string_replacer.php to convert the text into HTML. Once the authenticated victim opens the email, the malicious link is rendered or triggered, executing the attacker's arbitrary JavaScript payload within the context of the victim's active session.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability, this flaw is actively exploited in the wild. Successful exploitation allows attackers to steal sensitive session cookies, hijack active user sessions, bypass CSRF protections, and gain unauthorized access to the victim's mailbox. This can lead to unauthorized data exfiltration, spear-phishing campaigns initiated from compromised internal accounts, and further lateral movement within the corporate network.