Attack Chain

1. Attacker crafts a malicious SVG file containing JavaScript within event-handler attributes.
2. Attacker sends the crafted SVG file as an email attachment to a targeted user.
3. Victim accesses their account via the vulnerable KerioConnect Webmail interface.
4. Victim interacts with or triggers a preview of the malicious email attachment.
5. The KerioConnect temporary-download endpoint serves the SVG content.
6. Due to an insufficient Content-Security-Policy (CSP) sandbox, the embedded JavaScript executes in the victim's browser session.
7. Malicious scripts exfiltrate user credentials or mailbox contents to an attacker-controlled server.

Impact

Confirmed exploitation results in unauthorized credential theft and access to mailbox contents for authenticated users.

Recommendation

Upgrade all GFI KerioConnect installations to version 10.0.8 Patch 2 or later immediately.