Roundcube has issued critical security updates with the release of versions 1.6.18 and 1.7.3, addressing eleven vulnerabilities that could compromise the webmail platform. These updates rectify issues including remote code execution (RCE), server-side request forgery (SSRF) bypasses, injection flaws, and stored cross-site scripting (XSS) vulnerabilities.
Administrators utilizing Roundcube versions 1.6.x or 1.7.x are strongly advised to upgrade immediately. The most severe of these vulnerabilities is an RCE flaw within the ‘markasjunk’ plugin’s ‘cmd_learn’ driver, which interfaces with spam-learning backends. Exploitation of this flaw could allow attackers to execute arbitrary commands within the Roundcube environment, posing significant risks to the webmail server and potentially other connected systems.
Addressing SSRF and Injection Vulnerabilities
The updates also resolve SSRF filter bypass vulnerabilities in Roundcube’s local URL validation logic. SSRF vulnerabilities enable attackers to make the application send requests to unintended locations, including internal services not publicly accessible. Specific bypasses involved special local address ranges and crafted hostnames that could evade existing checks.
Additional fixes include an LDAP filter injection flaw, arbitrary Sieve script injection, IMAP command injection, stored XSS in the ‘Add to address book’ action, and HTML/CSS sanitization bypasses. These vulnerabilities, if exploited, could lead to unauthorized access, data theft, or further exploitation within the affected systems.
Given the critical nature of these vulnerabilities, administrators should promptly upgrade to Roundcube 1.6.18 or 1.7.3, depending on their release branch. It’s also advisable to assess the necessity of the ‘markasjunk’ plugin and disable it if not in use. Implementing outbound connection restrictions from the Roundcube host and limiting access to sensitive internal services can further mitigate SSRF risks.
These updates underscore the importance of regular software maintenance and prompt application of security patches to safeguard against emerging threats. Organizations should remain vigilant and proactive in their cybersecurity practices to protect their communication infrastructures.
