Unpatched Bug in RainLoop Webmail Could Give Hackers Access to all Emails

An unpatched high-severity security flaw has been disclosed in
the open-source RainLoop web-based email client that could be
weaponized to siphon emails from victims’ inboxes.

“The code vulnerability […] can be easily exploited by an
attacker by sending a malicious email to a victim that uses
RainLoop as a mail client,” SonarSource security researcher Simon
Scannell said^[1]
in a report published this week.

“When the email is viewed by the victim, the attacker gains full
control over the session of the victim and can steal any of their
emails, including those that contain highly sensitive information
such as passwords, documents, and password reset links.”

Tracked as CVE-2022-29360, the flaw relates to a stored
cross-site-scripting (XSS) vulnerability impacting the latest
version of RainLoop (v1.16.0^[2]) that was released on
May 7, 2021.

Stored XSS flaws, also called persistent XSS, occur when a
malicious script is injected directly into a target web
application’s server by means of user input (e.g., comment field)
that’s permanently stored in a database and is later served to
other users.

Impacting all RainLoop installations running under default
configurations, attack chains leveraging the flaw could take the
form of a specially crafted email sent to potential victims that,
when viewed, executes a malicious JavaScript payload in the browser
without requiring any user interaction.

SonarSource, in its disclosure timeline, said that it notified
the maintainers of RainLoop of the bug on November 30, 2021, and
that the software maker has failed to issue a fix for more than
four months.

An issue^[3]
raised on GitHub by the Swiss code quality and security company on
December 6, 2021, remains open to date. We have reached out to
RainLoop for comment, and we will update the story if we hear
back.

In the absence of patches, SonarSource is recommending users to
migrate to a RainLoop fork called SnappyMail^[4], which is actively
maintained and unaffected by the security issue.