Roundcube Webmail Patches 12 Security Flaws, Including Zero-Click XSS and SSRF Bypass
Roundcube Webmail has released versions 1.6.19 and 1.7.4 to address 12 vulnerabilities, including a zero-click stored XSS, XSS in the HTML editor, and multiple email header injection flaws.
Roundcube Webmail has released critical security updates for its 1.6 LTS and 1.7 branches, addressing a total of 12 vulnerabilities that could expose users and servers to a range of attacks. The new releases, versions 1.6.19 and 1.7.4, aim to fix flaws in how the open-source webmail platform processes email content, HTML, Cascading Style Sheets, attachment metadata, contact groups, and remote URLs. Administrators running production deployments are strongly urged to update their systems as soon as possible to mitigate these risks.
Among the most severe issues patched is a zero-click stored cross-site scripting (XSS) vulnerability. This flaw arises from the injection of TNEF (Transport Neutral Encapsulation Format) MIME tags into attachment URLs. TNEF, commonly associated with Microsoft Outlook attachments, could be exploited by an attacker sending a specially crafted email. When a victim views this message, malicious scripts could execute without requiring the user to click any links or open any attachments, leading to potential session hijacking or data theft.
Further XSS vulnerabilities were also addressed, including one within Roundcube’s HTML editor that could be triggered when handling text/enriched email content. Such XSS weaknesses can allow attackers to execute arbitrary JavaScript within a victim’s webmail session. This could enable them to steal session tokens, modify mailbox settings, read sensitive messages, or perform actions on behalf of the logged-in user.
The updates also tackle several email header injection risks. Vulnerabilities were found in the subject field, recipient display name, and an identity’s organization field. Attackers could exploit these flaws to manipulate email metadata or inject unexpected mail headers if malicious input is not properly sanitized, potentially leading to phishing or other social engineering attacks.
Additionally, a cross-user data access issue affecting SQL-based address books has been resolved. This flaw, related to adding or removing members from contact groups, could have allowed one user to modify another user’s group associations under specific circumstances. This poses a significant risk to contact privacy and data integrity, particularly in shared or hosted Roundcube environments.
Several fixes were implemented to address bypasses in remote-content protections. These include vulnerabilities related to CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and the exploitation of SVG SMIL source animation techniques. These issues could have allowed attackers to circumvent intended content restrictions.
Finally, the updates resolve an is_local_url() validation bypass involving fully qualified domain names with a trailing dot in stylesheet URLs, which could trick the system into treating external resources as local. A server-side request forgery (SSRF) bypass in the Roundcube CSS proxy was also patched, specifically addressing weaknesses involving hexadecimal IPv6-mapped IPv4 addresses that could allow attackers to force the server to request internal or restricted network resources.
Roundcube has provided full technical details in the release notes for versions 1.6.19 and 1.7.4, strongly recommending that all organizations operating affected installations apply these updates promptly to secure their webmail infrastructure.