Weaponizing XSS: Cyberespionage tactics in webmail exploitation

Weaponizing XSS: Cyberespionage Tactics in Webmail Exploitation

Speaker: Matthieu Faou — ESET

Conference: NorthSec 2025 — May 15–16, 2025, Marché Bonsecours, Montreal

Watch on YouTube: https://www.youtube.com/watch?v=lex_Kxr24uo

Reading time: ~8 minutes

TL;DR

ESET Senior Malware Researcher Matthieu Faou presented two years of research into XSS exploitation in on-premises webmail applications — Roundcube, MDaemon, Zimbra, and Horde. The research identified two zero-day vulnerabilities (CVE-2023-5631 in Roundcube, CVE-2024-11182 in MDaemon), multiple N-day exploits used in the wild, and detailed JavaScript payload analysis across three state-sponsored cyberespionage groups: Russia-aligned Sednit (APT28) and GreenCube, and Belarus-aligned Winter Vivern. The talk provides a practical map of how regex- and deny-list-based HTML sanitizers fail against parser confusion attacks and whitespace tricks.

Introduction

Desktop mail clients and mail server software have attracted significant vulnerability research — Exchange and Outlook exploits appear regularly in threat intelligence reports. On-premises webmail applications have received less scrutiny but present a structurally different and in some ways more exploitable attack surface.

A webmail is, by definition, a web application that renders untrusted HTML content — the body of incoming emails — in a browser. The core security challenge is distinguishing legitimate HTML formatting from malicious JavaScript injection, using a sanitizer that operates on attacker-controlled input. Matthieu Faou, who works from ESET's Montreal research office, spent two years documenting how that challenge is being met — and consistently failing — across four webmail applications, and how three cyberespionage groups have weaponized those failures for targeted intelligence collection.

A meta-note from the talk: one NorthSec conference presenter reportedly attempted to inject an XSS payload into their biography field on the conference website. It worked initially; the organizers patched the website before the conference. The anecdote neatly illustrated Faou's opening point about how pervasive the vulnerability class is.

▶ Watch: XSS fundamentals and webmail attack surface (0:00)

Why Webmail Sanitizers Fail

All four targeted applications — Zimbra, Roundcube, Horde, and MDaemon — implement HTML sanitization to prevent script execution in rendered emails. None uses a strict allowlist-based parser; instead, all rely on regex patterns and hardcoded deny lists. This approach fails in two predictable ways: parser confusion attacks and filter bypass through HTML structure manipulation.

Roundcube's sanitizer, called the "washer" (rcube_washtml.php), is open-source and available on GitHub. It maintains a list of completely forbidden HTML elements — script, applet, embed, and style — plus per-element attribute restrictions. Elements not in the forbidden list are permitted but have their attributes screened. Faou's research found multiple bypass paths through this washer, and similar structural weaknesses in MDaemon's C-based parser, Zimbra's header handling, and Horde.

▶ Watch: Webmail sanitizer architecture and failure modes (4:00)

Four Exploited Vulnerabilities

CVE-2023-5631: Roundcube Whitespace Bypass (Winter Vivern, Zero-Day)

The first vulnerability Faou covered was a zero-day used by Winter Vivern in 2023, which ESET discovered and reported to the Roundcube team. The patch was deployed within two days.

The attack email contained an SVG element with a nested SVG element inside it. Roundcube's washer was designed to prevent SVG-in-SVG structures because unsanitized HTML can be embedded within SVG content and executed as JavaScript. However, the inner SVG tag was written as S VG — with a whitespace character inserted between S and VG. The washer's tag detection failed to identify this as an SVG element and permitted it. The Base64-encoded payload inside a <use> tag within the outer SVG decoded to a second SVG element with JavaScript in an event handler attribute.

The fix was a single call to trim() on the element name before comparison. The fragility of the sanitizer against this trivial bypass illustrates the fundamental weakness of pattern-matching approaches to HTML security.

▶ Watch: CVE-2023-5631 Roundcube whitespace bypass (6:00)

CVE-2024-11182: MDaemon HTML Parser Confusion (Sednit, Zero-Day)

MDaemon's sanitizer is implemented in C and uses a different HTML parser than the browser it serves content to. This parser discrepancy creates a class of attacks where the sanitizer and the browser construct different DOM trees from the same input.

The Sednit-used payload opened a <noembed> tag followed by a <p> tag. Inside the <p> tag's title attribute, the payload closed the <noembed> and opened an <img> tag. From the sanitizer's perspective, the <img> tag was inside a title attribute — text content, not a parsed element. The browser's more lenient HTML5 parsing produced a different tree in which the <img> tag was a real element, and its event handler attribute executed JavaScript.

ESET was unable to fully reverse-engineer MDaemon's C parser to identify the exact discrepancy, but demonstrated that the confusion was not limited to <noembed> — a <div> with a style attribute triggered equivalent behavior, indicating a systemic parsing inconsistency. MDaemon released a beta patch within 30 days and a production release approximately a month later.

▶ Watch: CVE-2024-11182 MDaemon parser confusion (10:00)

CVE-2024-27443: Zimbra Calendar Header Injection (Sednit, N-Day)

In this case, ESET was not the original discoverer. The vulnerability was already patched when Sednit began exploiting it in 2024, making it an N-day attack — using a known vulnerability against organizations that had not yet applied the patch.

The flaw was in the X-Zimbra-Calendar-Intended-For email header: its value was inserted directly into the rendered webpage without any sanitization. Placing JavaScript in this header caused it to execute when the recipient opened the email in the Zimbra web client. The fix was adding sanitization to the msg.cif component that processes the header value.

This vulnerability is particularly notable because the payload was not in the email body but in the message header — a vector that many email security gateways do not inspect at the same depth as body content.

Roundcube Hyperlink Injection (Sednit, 2024)

A second Roundcube vulnerability exploited by Sednit in 2024 resided not in the washer but in the hyperlink display text functionality. Roundcube allows composing emails with display text substituted for URLs in links. The code that extracted the display text used a regex that was bypassable by inserting JavaScript between brackets in place of text. Execution occurred when the recipient hovered over or processed the link in their browser. The fix was forbidding < and > characters in that context.

▶ Watch: Zimbra and Roundcube N-day exploitation (12:00)

Three Cyberespionage Groups and Their Payloads

Sednit (APT28 / Fancy Bear)

Sednit is publicly attributed to the Russian GRU and is among the most active cyberespionage groups in operation. Their portfolio includes the 2016 DNC breach, TV5Monde compromise, and World Anti-Doping Agency attacks. Faou's research identified Sednit targeting webmail applications in Ecuador, Bulgaria, Serbia, Romania, Ukraine, Greece, Cyprus, and Cameroon, with approximately 80% of targets in Ukraine — primarily defense organizations, national government agencies, and aerospace companies.

ESET named this specific campaign Operation RoundPress. Sednit's JavaScript payloads exfiltrate email contents and contacts from within the active browser session, exploiting the authenticated context that XSS provides. Because the JavaScript runs in the context of the logged-in webmail session, it has access to all data the user can see and can interact with any authenticated API the webmail exposes — without needing the user's credentials.

▶ Watch: Sednit / Operation RoundPress (14:00)

Winter Vivern

Winter Vivern is aligned with Belarusian state interests and focuses primarily on European government and diplomatic targets. The group used CVE-2023-5631 against Roundcube as a zero-day before ESET reported it and patched it within two days. More recently, Winter Vivern was observed exploiting a vulnerability in .ics calendar attachment fields — a mechanism similar to the Zimbra X-Zimbra-Calendar-Intended-For header injection, but targeting a field in iCalendar invitation attachments that was not properly sanitized before display.

Winter Vivern's payloads focus on session data exfiltration: once the XSS fires, the JavaScript payload reads the active session's email data and contacts and transmits them to attacker infrastructure.

GreenCube

GreenCube operates in a more targeted fashion against specific organizations in Eastern Europe and Central Asia. ESET's research documented the group using N-day Roundcube vulnerabilities to target organizations in the defense and government sectors. GreenCube's payloads are technically similar to Sednit's — JavaScript execution in the webmail context enabling email exfiltration — but the targeting profile is narrower and the operational tempo lower.

▶ Watch: GreenCube and Winter Vivern payload analysis (20:00)

Defensive Implications

The attack chain for all three groups follows the same structure: craft a malicious email exploiting a sanitizer bypass, send it to the target's webmail address, and wait for the victim to open the email in their vulnerable webmail client. No user interaction beyond opening the email is required. There is no attachment to execute, no link to click, and no warning presented by the mail client.

Key defensive responses:

• Keep on-premises webmail software current. Multiple vulnerabilities in this research were N-days — fully patched but exploited against unpatched deployments. Roundcube's two-day patch turnaround and MDaemon's 30-day beta cycle set reasonable expectations; deployments should track and apply patches on equivalent timescales.
• Consider hosted alternatives where feasible. Cloud-hosted webmail services (Gmail, Exchange Online) have larger security teams, more aggressive patch cadences, and do not expose self-managed attack surfaces to the same zero-day risk.
• Monitor for unusual email header content. The Zimbra vulnerability resided in a custom header (X-Zimbra-Calendar-Intended-For). Email security gateways that only inspect body content would miss this vector.
• Network egress filtering from webmail servers. Because XSS payloads execute in the browser, exfiltration traffic originates from the user's browser, not the mail server. Detection requires monitoring for unusual JavaScript-initiated network requests rather than server-side indicators.

Notable Quotes

"We can describe a webmail as a web interface that displays untrusted HTML content — the content being emails. And often those sanitizers are based on regexes or hardcoded deny lists. So attackers can either find a way to trick the HTML parser or bypass the filter." — Matthieu Faou

"It worked at first, then we had to change their website." — Faou, on the NorthSec conference presenter who successfully injected XSS into their conference biography

"The fix was actually quite simple. They just added a call to the trim function, which removes all whitespace. So now 'S VG' will be converted to 'SVG' and will be correctly detected by the washer. It's a very simple trick, but it shows that those sanitizers are really not robust." — Matthieu Faou on CVE-2023-5631

Key Takeaways

1. Regex and deny-list sanitizers are structurally inadequate for webmail HTML rendering. All four affected applications relied on pattern-matching approaches that fail against parser confusion, whitespace manipulation, and structural tricks. Strict allowlist-based parsing would have prevented most of these exploits.

1. Parser discrepancies between sanitizer and browser are an exploitable class. Wherever a server-side sanitizer uses a different HTML parser than the client browser, attackers can craft inputs that parse as safe on the server and dangerous in the browser — as demonstrated in MDaemon's C-parser versus browser DOM discrepancy.

1. Email headers are a neglected injection surface. The Zimbra X-Zimbra-Calendar-Intended-For vulnerability and the Winter Vivern .ics field vulnerability both exploited metadata fields rather than email bodies — vectors that many email security products do not inspect.

1. XSS in webmail provides authenticated API access without credentials. JavaScript executing in the context of a logged-in webmail session can read all visible email, contact, and calendar data, and interact with any authenticated API exposed by the application, making credential theft unnecessary.

1. Zero-day webmail exploits support targeted espionage at low operational cost. A single crafted email sent to a high-value target's webmail address can silently exfiltrate email archives without user interaction beyond reading mail — and the attack leaves no traces on the mail server itself.