- Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]

Credits to Oskar Zeino-Mahmalat (Sonar) https://www.sonarsource.com

Author: alecpl

CHANGELOG.md

@@ -15,6 +15,7 @@
 - Fix infinite loop when parsing malformed Sieve script (#9562)
 - Fix bug where imap_conn_option's 'socket' was ignored (#9566)
 - Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
+- Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
 
 ## Release 1.6.7
 

program/actions/mail/get.php

@@ -259,6 +259,11 @@ public function run($args = [])
                             $rcmail->gettext('allow'),
                             $rcmail->url(array_merge($_GET, ['_safe' => 1]))
                         );
+                    } else {
+                        // Use strict security policy to make sure no javascript is executed
+                        // TODO: Make the above "blocked resources button" working with strict policy
+                        // TODO: Move this to rcmail_html_page::write()?
+                        header("Content-Security-Policy: script-src 'none'");
                     }
                 }
 

program/lib/Roundcube/rcube_output.php

@@ -242,13 +242,20 @@ public function download_headers($filename, $params = [])
             $ctype = $params['type'];
         }
 
-        if ($disposition == 'inline' && stripos($ctype, 'text') === 0) {
-            $charset = $this->charset;
-            if (!empty($params['type_charset']) && rcube_charset::is_valid($params['type_charset'])) {
-                $charset = $params['type_charset'];
+        // Send unsafe content as plain text
+        if ($disposition == 'inline') {
+            if (preg_match('~(javascript|jscript|ecmascript|xml|html|text/)~i', $ctype)) {
+                $ctype = 'text/plain';
             }
 
-            $ctype .= "; charset={$charset}";
+            if (stripos($ctype, 'text') === 0) {
+                $charset = $this->charset;
+                if (!empty($params['type_charset']) && rcube_charset::is_valid($params['type_charset'])) {
+                    $charset = $params['type_charset'];
+                }
+
+                $ctype .= "; charset={$charset}";
+            }
         }
 
         if (is_string($filename) && strlen($filename) > 0 && strlen($filename) <= 1024) {
@@ -278,6 +285,9 @@ public function download_headers($filename, $params = [])
             header("Content-Length: " . $params['length']);
         }
 
+        // Use strict security policy to make sure no javascript content is executed
+        header("Content-Security-Policy: default-src 'none'");
+
         // don't kill the connection if download takes more than 30 sec.
         if (!array_key_exists('time_limit', $params)) {
             $params['time_limit'] = 3600;