CVE-2020-35730: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-35730 is a Cross-Site Scripting (XSS) vulnerability discovered in Roundcube Webmail affecting versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The vulnerability was disclosed on December 27, 2020, and affects the Roundcube Webmail application, a browser-based multilingual IMAP client (NVD, GitHub Release).

The vulnerability exists in the linkref_addindex function within rcube_string_replacer.php, where an attacker can send a plain text email message containing JavaScript code within a link reference element that is improperly handled by the application. The vulnerability has a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it requires user interaction but can be exploited remotely without authentication (NVD).

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context of the victim's browser session when viewing a maliciously crafted email message. This could lead to theft of sensitive information, session hijacking, or other client-side attacks (GitHub Release).

The vulnerability requires user interaction in the form of viewing a maliciously crafted email message. The attack can be executed by sending a specially crafted plain text email message containing JavaScript code in a link reference element. The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog, indicating it has been actively exploited in the wild (NVD).

The vulnerability has been fixed in Roundcube Webmail versions 1.2.13, 1.3.16, and 1.4.10. Users are strongly recommended to upgrade to these or later versions. The fix was implemented through patches that properly handle link reference elements in email messages. For version 1.4.x, the fix is available in commit 0bceba301aa621ecc0263eac17beee2a4cef0c6d (GitHub Release, Debian Bug).

The vulnerability was reported by security researcher Alex Birnberg and was quickly addressed by the Roundcube development team. Various Linux distributions, including Debian and Fedora, released security updates to address this vulnerability. The Roundcube team emphasized the importance of updating all productive installations, particularly for users of the LTS versions (GitHub Release, Fedora Update).