Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

nullcathedral.com

Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

nullcathedral.com

RSS Bot@lemmy.bestiver.seBM to Hacker News@lemmy.bestiver.seEnglish · 8 months ago

Roundcube Webmail <1.5.13 / <1.6.13 allows attackers to force remote image loads via SVG feImage

nullcathedral.com

Roundcube's HTML sanitizer doesn't treat SVG feImage href as an image source. Attackers can bypass remote image blocking to track email opens.

Comments

You must log in or register to comment.

Chat

Hacker News@lemmy.bestiver.se

hackernews@lemmy.bestiver.se

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !hackernews@lemmy.bestiver.se

Community locked: only moderators can create posts. You can still comment on posts.

Posts from the RSS Feed of HackerNews.

The feed sometimes contains ads and posts that have been removed by the mod team at HN.

Source of the RSS Bot

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

324 users / day
1.71K users / week
3.08K users / month
7.44K users / 6 months
14 local subscribers
5.52K subscribers
25.7K Posts
14K Comments
Modlog