RoundCube Webmail Cross-Site Scripting (XSS) Exploitation Attempt

union
  (
    CommonSecurityLog
    | where DeviceVendor has_any ("Apache", "nginx", "Microsoft") or DeviceProduct has_any ("IIS", "Apache", "nginx")
    | where RequestURL has "/roundcube/" or RequestURL has "/?_task=mail" or RequestURL has "/?_task=compose"
    | where RequestURL matches regex @"(?i)(<script|javascript:|on\w+\s*=|<img[^>]+src\s*=|<svg[^>]+on\w+|data:text/html|vbscript:)"
       or AdditionalExtensions matches regex @"(?i)(<script|javascript:|on\w+\s*=|<img[^>]+src\s*=|<svg[^>]+on\w+|data:text/html)"
    | extend AttackIndicator = extract(@"(?i)(<script[^>]*>|javascript:[^'"]+|on\w+=\S+)", 0, RequestURL)
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, AttackIndicator, DeviceVendor, DeviceProduct
  ),
  (
    W3CIISLog
    | where csUriStem has_any ("/roundcube", "/webmail", "/mail")
    | where csUriQuery matches regex @"(?i)(<script|javascript:|on\w+\s*=|<img[^>]+onerror|<svg|data:text/html)"
       or csUriStem matches regex @"(?i)(<script|javascript:|on\w+\s*=)"
    | project TimeGenerated, cIP, csUriStem, csUriQuery, csMethod, scStatus
  )
| where TimeGenerated > ago(24h)
| summarize EventCount = count(), UniqueIPs = dcount(SourceIP) by bin(TimeGenerated, 5m), RequestURL
| where EventCount > 1

index=web OR index=proxy OR index=mail
(sourcetype=access_combined OR sourcetype=apache_access OR sourcetype=nginx_access OR sourcetype=iis)
(
  (uri="*/roundcube*" OR uri="*webmail*" OR uri_path="*/mail*")
  AND (
    uri_query IN ("*<script*", "*javascript:*", "*onerror=*", "*onload=*", "*<svg*", "*data:text/html*", "*vbscript:*")
    OR uri IN ("*<script*", "*javascript:*", "*onerror=*", "*onload=*")
    OR form_data IN ("*<script*", "*javascript:*", "*onerror=*", "*onload=*")
  )
)
| eval xss_pattern=case(
    match(uri_query, "(?i)<script"), "script_tag",
    match(uri_query, "(?i)javascript:"), "javascript_uri",
    match(uri_query, "(?i)on\\w+="), "event_handler",
    match(uri_query, "(?i)data:text/html"), "data_uri",
    true(), "generic_xss"
  )
| stats count as request_count, dc(src_ip) as unique_sources, values(uri) as targeted_uris, values(xss_pattern) as attack_patterns by _time, src_ip, dest, http_method, status
| where request_count >= 1
| sort -request_count

sequence by source.ip with maxspan=10m
  [network where event.category == "network" and
   http.request.method in ("GET", "POST") and
   url.path : ("*/roundcube*", "*/webmail*", "*/?_task=mail*", "*/?_task=compose*") and
   (
     url.query : ("*<script*", "*javascript:*", "*onerror=*", "*onload=*", "*<svg*", "*data:text/html*") or
     http.request.body.content : ("*<script*", "*javascript:*", "*onerror=*", "*onload=*")
   )
  ]
  [network where event.category == "network" and
   http.response.status_code in (200, 302) and
   url.path : ("*/roundcube*", "*/webmail*")
  ]

SELECT
  sourceip,
  destinationip,
  URL,
  'HTTP Request Method' as requestMethod,
  'HTTP Response Code' as responseCode,
  starttime,
  QIDNAME(qid) as eventName,
  logSourceName(logsourceid) as logSource
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'nginx', 'Microsoft IIS', 'Squid Proxy')
  AND (
    URL IMATCHES '.*roundcube.*'
    OR URL IMATCHES '.*webmail.*'
    OR URL IMATCHES '.*[?&]_task=(mail|compose).*'
  )
  AND (
    URL IMATCHES '.*<script.*'
    OR URL IMATCHES '.*javascript:.*'
    OR URL IMATCHES '.*(onerror|onload|onclick|onmouseover)\\s*=.*'
    OR URL IMATCHES '.*<svg[^>]*(onload|onerror).*'
    OR URL IMATCHES '.*data:text/html.*'
    OR URL IMATCHES '.*vbscript:.*'
  )
  AND CATEGORYNAME(category) IN ('Web Application Attack', 'Cross-Site Scripting', 'Suspicious Activity')
LAST 24 HOURS

_sourceCategory=web/access OR _sourceCategory=proxy/logs OR _sourceCategory=mail/webserver
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) .* \"(?P<method>\w+) (?P<uri>[^\"]+) HTTP\/[\d\.]+\" (?P<status>\d+)"
| where (uri matches "*roundcube*" or uri matches "*webmail*" or uri matches "*_task=mail*" or uri matches "*_task=compose*")
| where (
    uri matches "*<script*" or
    uri matches "*javascript:*" or
    uri matches "*onerror=*" or
    uri matches "*onload=*" or
    uri matches "*<svg*" or
    uri matches "*data:text/html*" or
    uri matches "*vbscript:*"
  )
| parse field=uri "*" as full_uri nodrop
| if(uri matches "*<script*", "script_tag",
    if(uri matches "*javascript:*", "javascript_uri",
      if(uri matches "*onerror=*" or uri matches "*onload=*", "event_handler",
        "other_xss"))) as attack_type
| stats count as total_attempts, count_distinct(src_ip) as unique_attackers, values(attack_type) as attack_types by _timeslice(5m), src_ip, status
| where total_attempts >= 1
| sort by total_attempts desc

rule roundcube_xss_exploitation_cve_2025_68461 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects XSS exploitation attempts targeting RoundCube Webmail CVE-2025-68461"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-68461"
    tags = "cve-2025-68461, xss, roundcube, webmail, kev"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    (
      $http.target.url.path = /.*roundcube.*/  or
      $http.target.url.path = /.*webmail.*/  or
      $http.target.url.query = /.*_task=(mail|compose).*/
    )
    (
      $http.target.url.query = /<script/i or
      $http.target.url.query = /javascript:/i or
      $http.target.url.query = /on\w+\s*=/i or
      $http.target.url.query = /<svg/i or
      $http.target.url.query = /data:text\/html/i or
      $http.target.url.query = /vbscript:/i or
      $http.network.http.request_body = /<script/i or
      $http.network.http.request_body = /javascript:/i
    )

  match:
    $http.principal.ip over 10m

  outcome:
    $risk_score = 75
    $attacker_ip = $http.principal.ip
    $target_url = $http.target.url.full
    $http_method = $http.network.http.method
    $response_code = $http.network.http.response_code

  condition:
    $http
}

#event_simpleName=NetworkConnectIP4
| NetworkRemotePort in (80, 443, 8080, 8443)
| RemoteAddressIP4 != "127.0.0.1"
// Look for RoundCube webmail process context
| join (
    #event_simpleName=ProcessRollup2
    | ImageFileName in ("/usr/share/roundcube/*", "*\\roundcube\\*", "*\\webmail\\*")
    | CommandLine matches regex "(?i)(php|php-fpm)"
  ) [LocalAddressIP4, aid]
| groupby [RemoteAddressIP4, LocalAddressIP4, LocalPort, aid, ComputerName]
| stats count() as ConnectionCount by RemoteAddressIP4, LocalAddressIP4, ComputerName, LocalPort
| where ConnectionCount > 5
| sort ConnectionCount desc

// Supplemental: Script engine spawned from web process
| union (
    #event_simpleName=ProcessRollup2
    | ParentBaseFileName in ("php", "php-fpm", "php7.4", "php8.0", "php8.1", "php8.2", "php8.3")
    | FileName in ("sh", "bash", "curl", "wget", "python", "python3", "perl", "nc", "ncat")
    | CommandLine != ""
    | select [ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid, timestamp]
  )