CVE-2024-45800

SnappyMail's cleanHtml() function, used to sanitize HTML and CSS in emails, contained a mutation XSS (mXSS) vulnerability. The function permitted an overly broad set of invalid HTML elements, allowing an attacker to craft malformed markup that the browser would reinterpret into valid, executable HTML. This flaw stemmed from the sanitizer relying on a blacklist of disallowed tags instead of a strict allowlist, and from an incorrect fix for broken Microsoft Outlook/Word styles [1][2].

Exploitation involves sending a specially crafted email containing nested elements such as `, , , and which, after sanitization, are transformed by the browser into a state that can include arbitrary ` tags. These tags can force requests to attacker-controlled servers or, more critically, load JavaScript attachments from the email. The latter attack is particularly challenging because it requires guessing the email's unique UID, a number ranging from 1 to 18446744073709551615 [2].

A successful attack could leak data by making requests through the email proxy to localhost resources (e.g., http://localhost:5000/leak) or achieve XSS if the attacker can load a JavaScript attachment. However, the default Content Security Policy (CSP) significantly reduces the impact, limiting the XSS surface [1][2].

The vulnerability is fixed in SnappyMail v2.38.0, which now removes unsupported HTML elements via an allowlist. Users unable to upgrade on older versions can install the "Security mXSS" extension at /?admin#/packages as a partial mitigation, though this extension cannot protect encrypted messages or HTML attachments [1][2].