Roundcube Patches Critical RCE and SSRF Vulnerabilities in Latest Releases
Roundcube has released versions 1.6.18 and 1.7.3, fixing eleven security vulnerabilities including critical RCE and SSRF flaws.
Roundcube, a widely used webmail client, has issued urgent security updates with the release of versions 1.6.18 and 1.7.3. These new versions address a total of eleven security vulnerabilities, including critical remote code execution (RCE) and server-side request forgery (SSRF) flaws, alongside issues related to injection, cross-site scripting (XSS), and authentication token exposure.
The most severe vulnerability patched is a remote code execution flaw within the markasjunk plugin's cmd_learn driver. This vulnerability, reported by security researcher nept1337, could allow an attacker to execute arbitrary commands on the server hosting Roundcube. Given Roundcube's role in processing emails and connecting to backend systems like IMAP, a compromise could lead to data theft, persistence, or further network pivoting.
In addition to the RCE vulnerability, the updates also fix critical SSRF filter bypasses. These bypasses exploit weaknesses in Roundcube's local URL validation logic, enabling attackers to trick the webmail server into making requests to internal services that are not exposed to the public internet. Specific bypasses identified involved crafted hostnames like those from nip.io and sslip.io, and the use of special local address ranges such as 100.64.0.0/10 and fe80::/10. These SSRF flaws, reported by Dmytro Ivanenko and Milan Hoppe, could allow attackers to access internal administrative interfaces, cloud metadata endpoints, or other sensitive internal resources.
The release notes also detail fixes for several other significant vulnerabilities. These include an LDAP filter injection flaw, arbitrary Sieve script injection, IMAP command injection, and stored XSS within the "Add to address book" functionality. Furthermore, issues related to HTML/CSS sanitization bypasses and a password-driver vulnerability that could expose authentication tokens to user-controlled hosts have been resolved.
Researchers credited for their contributions to identifying and reporting these diverse vulnerabilities include Zach Hanley of Horizon3.ai, Paulos Yibelo of pwn.ai, vectrain, and meifukun. The breadth of these findings underscores the importance of keeping the Roundcube platform updated.
The affected versions are Roundcube 1.6.x prior to 1.6.18 and 1.7.x prior to 1.7.3. While Roundcube's advisory does not currently mention confirmed in-the-wild exploitation, the severity and number of patched vulnerabilities necessitate immediate action from administrators.
To mitigate these risks, administrators are strongly advised to upgrade to the latest versions, 1.6.18 or 1.7.3, depending on their current branch. For those not utilizing the markasjunk plugin, disabling it can provide an additional layer of security. Further hardening measures include restricting outbound network connections from the Roundcube server and limiting its access to only essential internal services to minimize the potential impact of any future SSRF exploitation.
This batch of vulnerabilities highlights the ongoing security challenges faced by widely deployed web applications. Regular patching and diligent security hygiene are crucial for protecting email infrastructure from compromise.