Vulnerability Summary
HackerOne disclosed report --> https://hackerone.com/reports/3486747 by nullcathedral
When allow_remote is set to false, Roundcube's HTML sanitizer https://github.com/roundcube/roundcubemail/blob/5162a0d9d7b05728500375611a2fb4fc55844c7c/program/lib/Roundcube/rcube_washtml.php blocks external resources in <img>, <image>, and <use> tags by checking their src/href attributes through is_image_attribute().
However, the <feImage> SVG filter primitive is allowlisted as an element but its href attribute is not recognized as an image source. Instead, it passes through wash_link() which permits external HTTP/HTTPS URLs.
Step 1: Send an HTML e-mail with embedded SVG
No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In