{"id":27876,"date":"2023-10-26T07:24:39","date_gmt":"2023-10-26T07:24:39","guid":{"rendered":"https:\/\/hosting.nl\/blog\/hackers-target-roundcube-update-3\/"},"modified":"2023-11-20T12:06:25","modified_gmt":"2023-11-20T12:06:25","slug":"hackers-target-roundcube-update-3","status":"publish","type":"post","link":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/","title":{"rendered":"Hackers target Roundcube (update #3)"},"content":{"rendered":"\n<p>A previously unknown XSS exploit in Roundcube lets hackers inject JavaScript into the Roundcube server application. We are consulting on steps to take and options to repair the leak in Roundcube.  <\/p>\n\n<p><strong>Update Oct. 27, 4:40 p.m.: All hosting environment have been patched. That&#8217;s nice going into the weekend!<\/strong><\/p>\n\n<p>Update Oct. 27, 2 p.m.: The patches for Roundcube are available and are currently being rolled out on all hosting environments. We expect the installation of the patch to be completed by 4 p.m.<\/p>\n\n<p>Update Oct. 26, 3:37 p.m.: We are currently waiting on our vendor for a patch. As soon as the patch is available we will install it.<\/p>\n\n<p>A team of hackers named Winter Vivern exploited a previously unknown vulnerability in the widely used webmail software Roundcube, <a href=\"https:\/\/www.eset.com\/nl\/over\/newsroom\/persberichten-overzicht\/persberichten\/eset-research-winter-vivern\/\">researchers from the security firm ESET said on Wednesday<\/a>.<\/p>\n\n<p>This vulnerability (known as <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-5631\">CVE-2023-5631<\/a>) allows malicious actors, by sending a specially crafted email, to load arbitrary JavaScript code into the Roundcube user&#8217;s browser window. By viewing this email, malicious parties can ensure that emails can be sent from the affected Roundcube user&#8217;s mailbox.<\/p>\n\n<figure class=\"wp-block-image size-full is-resized\"><img fetchpriority=\"high\" decoding=\"async\" width=\"582\" height=\"619\" src=\"https:\/\/hosting.nl\/wp-content\/uploads\/winter-vivern-email-roundcube-exploit.jpeg\" alt=\"\" class=\"wp-image-25160\" style=\"aspect-ratio:0.9402261712439418;width:367px;height:auto\" srcset=\"https:\/\/hosting.nl\/wp-content\/uploads\/winter-vivern-email-roundcube-exploit.jpeg 582w, https:\/\/hosting.nl\/wp-content\/uploads\/winter-vivern-email-roundcube-exploit-542x576.jpeg 542w, https:\/\/hosting.nl\/wp-content\/uploads\/winter-vivern-email-roundcube-exploit-338x360.jpeg 338w, https:\/\/hosting.nl\/wp-content\/uploads\/winter-vivern-email-roundcube-exploit-522x555.jpeg 522w, https:\/\/hosting.nl\/wp-content\/uploads\/winter-vivern-email-roundcube-exploit-391x416.jpeg 391w\" sizes=\"(max-width: 582px) 100vw, 582px\" \/><\/figure>\n\n<p>For more information on this leak in the Roundcube server application, we recommend <a href=\"https:\/\/www.eset.com\/nl\/over\/newsroom\/persberichten-overzicht\/persberichten\/eset-research-winter-vivern\/\">this excellent Dutch-language article<\/a> from ESET and <a href=\"https:\/\/arstechnica.com\/security\/2023\/10\/pro-russia-hackers-target-inboxes-with-0-day-in-webmail-app-used-by-millions\/\">this background article from ARS Technica<\/a>.  <\/p>\n\n<p>We are currently in discussions both internally and with our suppliers about the steps to take and options for fixing the leak in Roundcube.  <\/p>\n\n<h2 class=\"wp-block-heading\">Workaround<\/h2>\n\n<p>It is possible to temporarily use an alternative application for webmail. This is a change made per domain name, not per user. To change the webmail application to SOGo follow <a href=\"https:\/\/hosting.nl\/en\/support\/use-sogo-as-a-webmail-app\/\">this guide<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A previously unknown XSS exploit in Roundcube lets hackers inject JavaScript into the Roundcube server application. We are consulting on steps to take and options to repair the leak in Roundcube. Update Oct. 27, 4:40 p.m.: All hosting environment have been patched. That&#8217;s nice going into the weekend! Update Oct. 27, 2 p.m.: The patches [&hellip;]<\/p>\n","protected":false},"author":31,"featured_media":27540,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-27876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nieuws"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Hackers target Roundcube (update #3) | Hosting.NL<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers target Roundcube (update #3) | Hosting.NL\" \/>\n<meta property=\"og:description\" content=\"A previously unknown XSS exploit in Roundcube lets hackers inject JavaScript into the Roundcube server application. We are consulting on steps to take and options to repair the leak in Roundcube. Update Oct. 27, 4:40 p.m.: All hosting environment have been patched. That&#8217;s nice going into the weekend! Update Oct. 27, 2 p.m.: The patches [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/\" \/>\n<meta property=\"og:site_name\" content=\"Hosting.NL\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-26T07:24:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-11-20T12:06:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hosting.nl\/wp-content\/uploads\/blog-hacker.jpg?_t=1700481986\" \/>\n\t<meta property=\"og:image:width\" content=\"740\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mark Kraakman\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark Kraakman\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/\"},\"author\":{\"name\":\"Mark Kraakman\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#\\\/schema\\\/person\\\/253eee45e07e446cb0898ceff92b60e1\"},\"headline\":\"Hackers target Roundcube (update #3)\",\"datePublished\":\"2023-10-26T07:24:39+00:00\",\"dateModified\":\"2023-11-20T12:06:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/\"},\"wordCount\":268,\"publisher\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/uploads\\\/blog-hacker.jpg\",\"articleSection\":[\"Nieuws\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/\",\"url\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/\",\"name\":\"Hackers target Roundcube (update #3) | Hosting.NL\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/uploads\\\/blog-hacker.jpg\",\"datePublished\":\"2023-10-26T07:24:39+00:00\",\"dateModified\":\"2023-11-20T12:06:25+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/#primaryimage\",\"url\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/uploads\\\/blog-hacker.jpg\",\"contentUrl\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/uploads\\\/blog-hacker.jpg\",\"width\":740,\"height\":400,\"caption\":\"Hacker\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/hackers-target-roundcube-update-3\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Hosting.NL\",\"item\":\"https:\\\/\\\/hosting.nl\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hackers target Roundcube (update #3)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/hosting.nl\\\/en\\\/\",\"name\":\"Hosting.NL\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hosting.nl\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#organization\",\"name\":\"Hosting.NL\",\"url\":\"https:\\\/\\\/hosting.nl\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/uploads\\\/hostingnl-default-logo.png\",\"contentUrl\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/uploads\\\/hostingnl-default-logo.png\",\"width\":242,\"height\":50,\"caption\":\"Hosting.NL\"},\"image\":{\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/en\\\/#\\\/schema\\\/person\\\/253eee45e07e446cb0898ceff92b60e1\",\"name\":\"Mark Kraakman\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/litespeed\\\/avatar\\\/0a11949fee67bcd9899c52e4feab68e8.jpg?ver=1778686143\",\"url\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/litespeed\\\/avatar\\\/0a11949fee67bcd9899c52e4feab68e8.jpg?ver=1778686143\",\"contentUrl\":\"https:\\\/\\\/hosting.nl\\\/wp-content\\\/litespeed\\\/avatar\\\/0a11949fee67bcd9899c52e4feab68e8.jpg?ver=1778686143\",\"caption\":\"Mark Kraakman\"},\"url\":\"https:\\\/\\\/hosting.nl\\\/en\\\/blog\\\/author\\\/mark-kraakmancyso-group\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hackers target Roundcube (update #3) | Hosting.NL","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/","og_locale":"en_US","og_type":"article","og_title":"Hackers target Roundcube (update #3) | Hosting.NL","og_description":"A previously unknown XSS exploit in Roundcube lets hackers inject JavaScript into the Roundcube server application. We are consulting on steps to take and options to repair the leak in Roundcube. Update Oct. 27, 4:40 p.m.: All hosting environment have been patched. That&#8217;s nice going into the weekend! Update Oct. 27, 2 p.m.: The patches [&hellip;]","og_url":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/","og_site_name":"Hosting.NL","article_published_time":"2023-10-26T07:24:39+00:00","article_modified_time":"2023-11-20T12:06:25+00:00","og_image":[{"width":740,"height":400,"url":"https:\/\/hosting.nl\/wp-content\/uploads\/blog-hacker.jpg?_t=1700481986","type":"image\/jpeg"}],"author":"Mark Kraakman","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Mark Kraakman","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/#article","isPartOf":{"@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/"},"author":{"name":"Mark Kraakman","@id":"https:\/\/hosting.nl\/en\/#\/schema\/person\/253eee45e07e446cb0898ceff92b60e1"},"headline":"Hackers target Roundcube (update #3)","datePublished":"2023-10-26T07:24:39+00:00","dateModified":"2023-11-20T12:06:25+00:00","mainEntityOfPage":{"@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/"},"wordCount":268,"publisher":{"@id":"https:\/\/hosting.nl\/en\/#organization"},"image":{"@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/#primaryimage"},"thumbnailUrl":"https:\/\/hosting.nl\/wp-content\/uploads\/blog-hacker.jpg","articleSection":["Nieuws"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/","url":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/","name":"Hackers target Roundcube (update #3) | Hosting.NL","isPartOf":{"@id":"https:\/\/hosting.nl\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/#primaryimage"},"image":{"@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/#primaryimage"},"thumbnailUrl":"https:\/\/hosting.nl\/wp-content\/uploads\/blog-hacker.jpg","datePublished":"2023-10-26T07:24:39+00:00","dateModified":"2023-11-20T12:06:25+00:00","breadcrumb":{"@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/#primaryimage","url":"https:\/\/hosting.nl\/wp-content\/uploads\/blog-hacker.jpg","contentUrl":"https:\/\/hosting.nl\/wp-content\/uploads\/blog-hacker.jpg","width":740,"height":400,"caption":"Hacker"},{"@type":"BreadcrumbList","@id":"https:\/\/hosting.nl\/en\/blog\/hackers-target-roundcube-update-3\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Hosting.NL","item":"https:\/\/hosting.nl\/en\/"},{"@type":"ListItem","position":2,"name":"Hackers target Roundcube (update #3)"}]},{"@type":"WebSite","@id":"https:\/\/hosting.nl\/en\/#website","url":"https:\/\/hosting.nl\/en\/","name":"Hosting.NL","description":"","publisher":{"@id":"https:\/\/hosting.nl\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hosting.nl\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/hosting.nl\/en\/#organization","name":"Hosting.NL","url":"https:\/\/hosting.nl\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hosting.nl\/en\/#\/schema\/logo\/image\/","url":"https:\/\/hosting.nl\/wp-content\/uploads\/hostingnl-default-logo.png","contentUrl":"https:\/\/hosting.nl\/wp-content\/uploads\/hostingnl-default-logo.png","width":242,"height":50,"caption":"Hosting.NL"},"image":{"@id":"https:\/\/hosting.nl\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/hosting.nl\/en\/#\/schema\/person\/253eee45e07e446cb0898ceff92b60e1","name":"Mark Kraakman","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hosting.nl\/wp-content\/litespeed\/avatar\/0a11949fee67bcd9899c52e4feab68e8.jpg?ver=1778686143","url":"https:\/\/hosting.nl\/wp-content\/litespeed\/avatar\/0a11949fee67bcd9899c52e4feab68e8.jpg?ver=1778686143","contentUrl":"https:\/\/hosting.nl\/wp-content\/litespeed\/avatar\/0a11949fee67bcd9899c52e4feab68e8.jpg?ver=1778686143","caption":"Mark Kraakman"},"url":"https:\/\/hosting.nl\/en\/blog\/author\/mark-kraakmancyso-group\/"}]}},"_links":{"self":[{"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/posts\/27876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/comments?post=27876"}],"version-history":[{"count":1,"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/posts\/27876\/revisions"}],"predecessor-version":[{"id":27877,"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/posts\/27876\/revisions\/27877"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/media\/27540"}],"wp:attachment":[{"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/media?parent=27876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/categories?post=27876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hosting.nl\/en\/wp-json\/wp\/v2\/tags?post=27876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}