CVE-2020-35730: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

CVE-2020-35730 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail. An attacker can craft a plain-text email containing JavaScript inside a link reference element; when the message is processed, the application mishandles that content and can execute the script in the context of a victim’s browser session. For organizations that rely on Roundcube for web-based email access, successful exploitation can lead to session theft, unauthorized actions performed as the logged-in user, or further compromise of the mail environment. Confirm exact impact and affected releases against the vendor advisory.

How it works

The weakness is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). According to the public summary, the flaw resides in the function linkref_addinindex inside rcube_string_replacer.php. When Roundcube processes an incoming plain-text message, it attempts to turn certain link-style references into clickable elements. The code fails to sanitize JavaScript that an attacker places inside those references, so the script is later rendered and executed in the victim’s browser while the user is authenticated to the webmail interface.

An attacker simply needs the ability to deliver email to a target address; no prior authentication to Roundcube is required. Once the victim opens or previews the message, the injected script runs with the privileges of that user’s session. Typical XSS consequences—cookie theft, forged requests, or redirection to attacker-controlled content—apply, though the precise payload behavior must be verified against the vendor advisory rather than assumed.

Am I affected? How to find it in your systems

Roundcube Webmail is commonly deployed as a front-end for IMAP mail servers in enterprises, universities, hosting providers, and smaller organizations that prefer a self-hosted web client. It usually runs on Linux web servers under Apache, Nginx, or similar, often behind a reverse proxy.

• Inventory every host that serves a Roundcube installation: search package managers, web-root directories, and configuration-management databases for “roundcube” or the characteristic files (for example, the presence of rcube_string_replacer.php).
• Record the installed version and compare it with the fixed releases listed in the vendor advisory; do not rely on version numbers published elsewhere.
• Review mail-server logs and web-application logs for messages that contain unusual link-reference syntax or that trigger errors inside the string-replacer component.
• If you operate a SIEM, look for sudden spikes in authenticated Roundcube sessions originating from unexpected locations or for JavaScript-related errors in the browser console of users who recently opened unsolicited mail.

Because public detail on exact version ranges is limited, treat any unpatched Roundcube instance as potentially vulnerable until the vendor advisory confirms otherwise.

How to remediate

The primary remediation is to apply the security updates supplied by the Roundcube project, following the vendor’s installation instructions exactly. CISA’s required action is simply “Apply updates per vendor instructions.” After patching:

• Restart the web server and clear any opcode or application caches so the updated PHP files are loaded.
• Verify that the fixed code is present by checking the version string or the modified function in rcube_string_replacer.php.
• As a defense-in-depth measure for this class of XSS, ensure that Content-Security-Policy headers restrict inline script execution and that session cookies are marked HttpOnly and Secure.
• Re-test message rendering with a controlled sample that previously triggered the issue to confirm the sanitization now works.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment the Roundcube host so that only necessary internal networks can reach the web interface; block direct internet access if users can be routed through a VPN or bastion.
• Place a web-application firewall in front of the service and enable rules that detect and block common XSS patterns in email bodies or query strings; tune carefully to avoid false positives on legitimate mail.
• If operationally feasible, temporarily disable automatic link conversion or HTML preview features that rely on the vulnerable string-replacer path—confirm the exact configuration option in your Roundcube version.
• Increase monitoring: alert on any email that contains “javascript:” or encoded script fragments inside link-like constructs, and watch for anomalous post-authentication activity from webmail sessions.
• Educate users to avoid opening unexpected messages in the web client until the patch is applied; prefer a desktop client that does not share the same rendering path.

If your data may have been exposed

Actively exploited XSS vulnerabilities in webmail can lead to account takeover and subsequent data exposure. If you suspect compromise, reset affected user credentials, review mail-forwarding rules and sent-item history, and examine authentication logs for unauthorized access. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information have already appeared in public dumps. Document findings and follow your incident-response plan for any confirmed intrusion.