RainLoop WebMail Vulnerability

An unpatched high-severity security flaw has been disclosed in the open-source RainLoop web-based email client that could be weaponized to siphon emails from victims’ inboxes.

Tracked as CVE-2022-29360, the flaw relates to a stored cross-site-scripting vulnerability impacting the latest version of RainLoop v1.16.0

Stored XSS flaws, also called persistent XSS, occur when a malicious script is injected directly into a target web application’s server by means of user input that’s permanently stored in a database and is later served to other users.

Impacting all RainLoop installations running under default configurations, attack chains leveraging the flaw could take the form of a specially crafted email sent to potential victims that, when viewed, executes a malicious JavaScript payload in the browser without requiring any user interaction.

RainLoop has been informed about the bug on November 30, 2021, and that the software maker has failed to issue a fix for more than four months.Its recommended to migrate to a RainLoop fork called SnappyMail, which is actively maintained and unaffected by the security issue.