CVE-2020-35730

CVE-2020-35730 is a Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail, first discovered three years ago. The flaw has been actively exploited by threat actors in various campaigns. In the BlueDelta and APT28 campaigns, spear-phishing techniques were employed, with email attachments designed to exploit this vulnerability, along with CVE-2020-12641 and CVE-2021-44026, in the Roundcube email client. Upon opening these malicious emails, the vulnerabilities were triggered, enabling threat actors to run reconnaissance and exfiltration scripts, redirect incoming emails, and gather session cookies, user information, and address books. The threat actor Winter Vivern was observed exploiting this vulnerability, along with CVE-2023-5631, since October 11, 2023. The group manipulated news about the Russo-Ukrainian conflict to trick targets into opening harmful emails that leveraged these vulnerabilities. ESET researchers noted that besides known vulnerabilities in Roundcube [CVE-2020-35730], the group also took advantage of another XSS vulnerability in Zimbra [CVE-2022-27926]. Protection against these threats is provided by Check Point IPS blade and Threat Emulation, specifically for Roundcube Webmail Command Injection (CVE-2020-12641), Roundcube Webmail Cross-Site Scripting (CVE-2020-35730), and APT.Wins.Nobelium. As these vulnerabilities have been widely exploited, it's crucial for organizations using affected software to apply necessary patches and employ defensive measures to mitigate potential risks.