CVE-2024-11182

What it actually does

This vulnerability is a stored cross-site scripting flaw in MDaemon Email Server webmail handling before version 24.5.1c. A remote attacker can send a crafted HTML email containing JavaScript embedded through an img tag or related image-handling markup. When a user opens or previews the message in webmail, the script can execute in that user’s browser session under the webmail origin. Depending on browser controls and application protections, this can allow session abuse, user impersonation within webmail, data access visible to the user, malicious actions performed as the user, credential phishing, or loading additional attacker-controlled JavaScript.

Why it matters to the business

Successful exploitation can compromise webmail users without requiring them to download an attachment or run a program; simply viewing a malicious email may be enough. This can expose email contents, enable account misuse, support phishing or lateral social-engineering campaigns, and undermine trust in the mail platform. The issue is listed in CISA KEV with active exploitation observed in the wild and a remediation due date of 2025-06-09, so internet-facing or widely used MDaemon webmail deployments should be treated as high-priority even though the CVSS score is moderate.

How an attack unfolds

An attacker prepares an HTML email that abuses how vulnerable MDaemon webmail versions render image tags. The message is delivered to a target mailbox through normal email delivery paths. When the recipient opens or previews the email in the MDaemon webmail interface, the crafted img-related JavaScript executes in the browser in the context of the webmail application. From there, the attacker’s script may attempt to read data available to the session, issue webmail actions as the user, capture user-visible content, redirect the user to a phishing page, or load additional scripts from attacker-controlled infrastructure. Because exploitation is triggered through email rendering, the attack can scale through phishing campaigns and may be difficult for users to distinguish from ordinary email activity.

How to fix it

Upgrade MDaemon Email Server to version 24.5.1c or later. If immediate upgrade is not possible, reduce exposure by limiting webmail access to trusted networks or VPN, applying mail gateway filtering for suspicious HTML image-tag scripting patterns, disabling or restricting active HTML content rendering where supported, and increasing monitoring of webmail sessions. Because the vulnerability is in active exploitation and is listed in CISA KEV, compensating controls should be considered temporary only; patching remains the required remediation.

How to confirm the fix worked

Confirm the installed MDaemon Email Server version is 24.5.1c or later. Validate that webmail components were updated, services restarted, and no older vulnerable binaries remain in use. Review administrative update logs or product version information from the MDaemon console. Where safe and authorized, test with a benign HTML email containing non-executing image-tag event-handler markers to confirm the webmail renderer neutralizes or encodes active content rather than executing it. Also confirm mail security controls flag or quarantine messages containing JavaScript-bearing img tags and that webmail access logs show expected post-upgrade behavior.

Typical attack path

1. Identify an organization using MDaemon Email Server webmail exposed to users.
2. Craft an HTML email containing JavaScript in or around an img tag that is mishandled by vulnerable versions.
3. Send the message to one or more target mailboxes.
4. Wait for a user to open or preview the message in the webmail browser interface.
5. Execute JavaScript in the victim’s authenticated webmail session.
6. Abuse the session to view email content, perform webmail actions, redirect the user, harvest sensitive data visible to the browser, or load additional attacker-controlled code.
7. Use compromised mail access or user trust to continue phishing, exfiltration, or internal social-engineering activity.

How to detect it

To determine whether exploitation already occurred, review inbound email logs, mail gateway quarantine records, MDaemon mail stores, and webmail access logs for messages containing suspicious HTML image tags with JavaScript or event handlers. Focus on the period before upgrade and especially around known suspicious emails that users opened or previewed. Relevant log sources include MDaemon SMTP/inbound mail logs, webmail or WorldClient access logs, mail gateway and EDR telemetry, proxy/DNS logs for browser connections to unusual external domains at the time of email viewing, and mailbox audit data for unexpected actions. Look for HTML containing img tags with onerror, onload, javascript: URIs, encoded JavaScript, document.cookie access, fetch/XMLHttpRequest calls, or external script retrieval. Correlate suspicious message delivery time with webmail session activity, unusual client IPs, new forwarding rules, unexpected sent messages, mass mailbox access, or redirects to unknown domains. Since exploitation occurs in the user’s browser, server-side evidence may be indirect; preserve suspicious messages in raw MIME form and collect browser/proxy/DNS telemetry where available.

• <img
• onerror=
• onload=
• javascript:
• document.cookie
• XMLHttpRequest
• fetch(
• eval(
• atob(
• fromCharCode
• new Image()
• <script
• %3Cimg
• %3Cscript
• C:\MDaemon\Logs\WorldClient-*.log
• C:\MDaemon\Logs\MDaemon-*.log
• WorldClient.dll
• /WorldClient.dll

What your security team should do

• Immediately inventory all MDaemon Email Server deployments and determine whether webmail is enabled or internet-accessible.
• Upgrade all affected MDaemon Email Server instances to 24.5.1c or later, prioritizing externally accessible webmail systems.
• Because this is in CISA KEV with active exploitation, treat unpatched systems as potentially exposed and perform retrospective log and mailbox review.
• Search mail stores, mail gateway telemetry, and webmail logs for suspicious HTML emails containing img tags with JavaScript, event handlers, encoded script content, or external script-loading behavior.
• Review webmail access logs for unusual user activity after suspicious messages were opened, including abnormal source IPs, unexpected message access, forwarding-rule changes, or session anomalies.
• Temporarily restrict webmail access to trusted networks or VPN until patching and validation are complete.
• Harden email security controls to strip or sanitize active HTML content and block suspicious external resource loading in email where operationally feasible.
• Notify help desk and incident response teams to watch for reports of webmail redirects, unexpected prompts, or suspicious emails that execute content when previewed.