ET EXPLOIT Roundcube XSS via SVG Animate Attributes (CVE-2024-37383)

alert smtp any any -> [$HOME_NET,$SMTP_SERVERS] any (
    msg:"ET EXPLOIT Roundcube XSS via SVG Animate Attributes (CVE-2024-37383)";
    flow:established,to_server;
    content:"|3c|animate|20|";
    content:"attributename|3d 22|href|20 22|"; fast_pattern; nocase; distance:0;
    content:"values|3d 22|"; nocase;
    pcre:"/^[^\x22]*?javascript\x3a/Ri";
    reference:url,global.ptsecurity.com/en/research/pt-esc-threat-intelligence/fake-attachment-roundcube-mail-server-attacks-exploit-cve-2024-37383-vulnerability/;
    reference:cve,2024-37383;
    classtype:misc-attack;
    sid:2066622; rev:2;
    metadata:affected_product Roundcube, attack_target SMTP_Server, created_at 2026_01_08, cve CVE_2024_37383, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2026_02_04, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)