ET WEB_SPECIFIC_APPS Roundcube onanimationstart Cross Site Scripting Attempt (CVE-2024-42009)

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS Roundcube onanimationstart Cross Site Scripting Attempt (CVE-2024-42009)";
    flow:established,to_client;
    http.response_body;
    content:"onanimationstart|3d|eval|28|atob|28|"; fast_pattern;
    pcre:"/^.*(?:Lz9fdGFzaz1tYWls|8\x2fX3Rhc2s9bWFpb|vP190YXNrPW1haW)/R";
    reference:url,github.com/DaniTheHack3r/CVE-2024-42009-PoC/;
    reference:cve,2024-42009;
    classtype:web-application-attack;
    sid:2071267; rev:1;
    metadata:affected_product Roundcube, attack_target Client_Endpoint, tls_state plaintext, created_at 2026_07_22, cve CVE_2024_42009, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_07_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)