News for hackers. Stuff that matters.

A comment on Open source email pioneer Roundcube joins the Nextcloud family. Parent comment

Re:Open source email pioneer Roundcube joins the Nextcloud f... by SahAssar on Wednesday November 29, 2023 @04:57PM (#38465886)
None of what you mentioned protects against XSS which the parent mentioned. Things like having a proper CSP might but only if the application is built so it does not depend on insecure eval/inline and/or you can properly disallow fetch/connections to outside sources.

Everything you mentioned is about protecting things the app should not have access to. Many vulnerabilities are about intent (did the admin user really mean to truncate the db they have permission to truncate) or target (did the user really mean to export all my emails in an archive to [email protected]).

If you at all store any sensitive data within the application either serverside or clientside you need to consider the security of the application itself, not just the sandboxing/isolation.

[ Parent | on HN ]
Re:Open source email pioneer Roundcube joins the Nextcloud f... by stracer on Monday December 04, 2023 @12:51PM (#38520464)
Agreed, this is a nasty bug in the software, which makes it open to manipulation by anybody on the internet who can send you an email. It's a big failure of the RoundCube project, developers probably do not care about security of user data very much. The response to the bug report is "did something to fix this, closed", no comment on what is going to be done to prevent this stuff in the future. Which is disappointing for a flaw of such severity. I wouldn't be surprised if similar attacks on RoundCube are still possible.
[ Parent | on HN ]