Coverage › CVE-2023-5631
CVE-2023-5631 Mapped Sigma
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
- Vendor / product
- Roundcube — Webmail
- Description (CISA)
- Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
- Added to KEV
- 2023-10-26
- Due date
- 2023-11-16
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-79
- CISA notes
- https://roundcube.net/news/2023/10/16/security-update-1.6.4-released, https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15
https://nvd.nist.gov/vuln/detail/CVE-2023-5631 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1204.001 Malicious Link | exploitation technique | This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.
In recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.
The checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser. ref 1 |
live |
| T1041 Exfiltration Over C2 Channel | secondary impact | This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.
In recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.
The checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser. ref 1 |
live |
| T1059.007 JavaScript | primary impact | This vulnerability is exploited by an adversary via a malicious e-mail containing a crafted SVG document. When a user views the e-mail, the remote attacker can load arbitrary JavaScript code on the victim's machine.
In recent campaign Winter Vivern group exploited this vulnerability. The attack chains typically start with a phishing mail sent containing a Base64-encoded payload embedded in the HTML source code. The payload gets decoded and injects a remote javascript, checkupdate.js, in current user session.
The checkupdate.js script serves as a loader, enabling the execution of a final JavaScript payload which is designed to exfiltrate email messages. The attackers weaponized this XSS flaw to carry out their malicious activities, ultimately allowing them to harvest email messages from their victims' accounts to a C2 server. The attack chain requires minimal user interaction, the attack gets executed only in viewing the malicious email in a web browser. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1041 Exfiltration Over C2 Channel secondary impact
- DET0348 Detection Strategy for Exfiltration Over C2 Channel
AN0988 WindowsIdentifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.Tunable:
DataVolumeThresholdKnownBenignProcessesAN0989 LinuxMonitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.Tunable:OutboundEntropyScoreConnectionDurationAN0990 macOSDetects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.Tunable:ParentProcessAncestryProtocolListAN0991 ESXiDetects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.Tunable:GuestOSAllowListTransferSizeThresholdMBProtocolAllowList
Sigma rules tagged attack.t1041 (5)
Author: Florian Roth (Nextron Systems)
· 2024-05-31 · logsource: product=windows category=network_connection · 07837ab9-60e1-481f-a74d-c31fb496a94c
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2017-04-15 (modified 2021-11-27) · logsource: category=firewall · 881834a4-6659-4773-821e-1c151789d873
Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · b4e6b016-a2ac-4759-ad85-8000b300d61e
Detects instances where a TFTP service on an OpenCanary node has had a request.
Author: Daniil Yugoslavskiy, oscd.community
· 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
T1059.007 JavaScript primary impact
- DET0264 Cross-Platform Detection of JavaScript Execution Abuse
AN0733 WindowsDetects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.Tunable:
ParentProcessScriptPathTimeWindowUserContextEntropyScoreAN0734 macOSDetects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.macos:unifiedloglog stream with predicate 'eventMessage CONTAINS "osascript"'→ DC0029 Script ExecutionTunable:ScriptLocationParentProcessAPIInvocationAN0735 LinuxDetects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.Tunable:ScriptPathBinaryNameUserExecutionContextNetworkFollowUp
Sigma rules tagged attack.t1059.007 (29)
Author: Tim Shelton
· 2022-01-10 (modified 2026-02-17) · logsource: product=windows category=file_event · 002bdb95-0cf1-46a6-9e08-d38c128a6127
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe
Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
· 2019-10-21 (modified 2026-01-24) · logsource: product=windows category=process_creation · 05c36dd6-79d6-4a9a-97da-3db20298ab2d
Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-12-02) · logsource: product=windows category=file_event · 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
· 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Author: Michael Haag
· 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1e33157c-53b1-41ad-bbcc-780b80b58288
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
· 2017-11-10 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1fac1481-2dbc-48b2-9096-753c49b4ec71
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
Author: @SBousseaden (detection), Thomas Patzke (rule)
· 2019-02-01 (modified 2023-05-05) · logsource: product=windows category=create_remote_thread · 2e4e488a-6164-4811-9ea1-f960c7359c40
Detects remote thread creation from CACTUSTORCH as described in references.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.
Author: Pushkarev Dmitry
· 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: heyyanu
· 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Author: wagga, Jonhnathan Ribeiro, oscd.community
· 2020-01-12 (modified 2023-02-11) · logsource: product=windows category=process_creation · 5cddf373-ef00-4112-ad72-960ac29bac34
Detects command line parameters used by Koadic hack tool
Author: Josh Nickels, Michael Taggart
· 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
All 29 rules on the technique page →
T1204.001 Malicious Link exploitation technique
- DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)
AN0178 WindowsBehavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.NSM:Flow
Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST→ DC0085 Network Traffic ContentTunable:TimeWindowBrowserParentsUserPathsSuspiciousTLDsAllowedCDNsAN0179 LinuxBehavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.auditd:SYSCALLexecve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline→ DC0082 Network Connection Creationauditd:SYSCALLopen,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions→ DC0039 File CreationTunable:TimeWindowUserPathsHighRiskExtensionsDomainRiskScoreAN0180 macOSBehavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.NSM:ConnectionsNew outbound connection from Safari/Chrome/Firefox/Word→ DC0082 Network Connection Creationfs:fseventsCreate in /Users/*/Downloads or /private/var/folders/* with quarantine attribute→ DC0039 File CreationTunable:TimeWindowQuarantinePolicySuspiciousTLDs
Sigma rules tagged attack.t1204.001 (4)
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Florian Roth (Nextron Systems)
· 2019-04-05 (modified 2021-11-27) · logsource: product=linux · c67fc22a-0be5-4b4f-aad5-2b32c4b69523
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-19 · logsource: product=windows category=process_creation · d487ed4a-fd24-436d-a0b2-f4e95f7b2635
Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).
Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-03-25 (modified 2025-11-19) · logsource: product=windows category=registry_set · f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links.
ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages.
Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content,
such as one-liners that execute remotely hosted malicious files or scripts.