Roundcube Patches Critical RCE and SSRF Vulnerabilities in 1.6.18, 1.7.3

Key Takeaways

• Roundcube has released critical security updates, versions 1.6.18 and 1.7.3, addressing eleven vulnerabilities.
• The most severe flaw is a remote code execution (RCE) vulnerability found in the markasjunk plugin, alongside multiple server-side request forgery (SSRF) bypasses.
• These vulnerabilities affect Roundcube webmail platforms, posing risks of data theft, system compromise, and internal network access.
• Administrators are urged to update immediately and consider disabling the markasjunk plugin if not essential.

Roundcube, a widely used webmail client, has issued urgent patches in versions 1.6.18 and 1.7.3 to rectify a total of eleven security vulnerabilities. These updates are crucial for administrators, as they address a critical remote code execution (RCE) flaw, several server-side request forgery (SSRF) bypasses, various injection vulnerabilities, and stored cross-site scripting (XSS) issues.

The patches are specifically for Roundcube installations running on the 1.6.x and 1.7.x branches. The most pressing concern is an RCE vulnerability discovered within the markasjunk plugin. This flaw resides in the plugin’s cmd_learn driver, a component designed to interface with spam-learning backends.

Security researcher nept1337 is credited with identifying this significant vulnerability. Successful exploitation could grant an attacker the ability to execute arbitrary commands on the compromised Roundcube server. Such a breach could directly endanger the webmail environment and potentially serve as a pivot point to other interconnected systems within an organization’s infrastructure.

Given Roundcube’s extensive deployment as a browser-based email interface, its compromise carries substantial risk. The platform often handles sensitive email content, connects to IMAP servers, and may integrate with LDAP directories, Sieve filters, and spam management tools. A successful attack could therefore provide a critical entry point into an organization’s broader messaging ecosystem.

Roundcube 1.6.18 and 1.7.3 Released With Fix

An RCE exploit in this context could facilitate the theft of email data, enable attackers to maintain persistence within the network, or allow them to move laterally to other internal services. Beyond RCE, the new releases also address critical SSRF filter bypass vulnerabilities found in Roundcube’s local URL validation logic.

SSRF Vulnerabilities Explained

SSRF vulnerabilities allow attackers to coerce a web application into sending requests to arbitrary locations, including internal services that are not publicly exposed. One of the identified bypasses leveraged specific local address ranges, such as 100.64.0.0/10 and fe80::/10. Another technique involved specially crafted nip.io and sslip.io hostnames, which could circumvent the is_local_url() check designed to prevent such internal access.

Dmytro Ivanenko and Milan Hoppe are recognized for reporting these specific SSRF issues. In a real-world scenario, an attacker could exploit an SSRF vulnerability to access internal administrative interfaces, cloud metadata endpoints, or services confined to a private network interface. The ultimate impact of such an attack largely depends on the network’s architecture and the outbound access controls configured on the webmail server. However, Roundcube servers with broad internal connectivity are at heightened risk.

Additional Patches and Researcher Credits

The updates also include fixes for a range of other vulnerabilities, including an LDAP filter injection flaw, arbitrary Sieve script injection, and IMAP command injection. Stored XSS vulnerabilities in the “Add to address book” action and various HTML/CSS sanitization bypasses have also been addressed. Furthermore, Roundcube resolved a password-driver issue that could inadvertently expose an authentication token to a user-controlled host.

A broader group of researchers contributed to these findings, including Zach Hanley of Horizon3.ai, Paulos Yibelo of pwn.ai, vectrain, and meifukun. The vulnerabilities impact Roundcube 1.6.x versions prior to 1.6.18 and 1.7.x versions prior to 1.7.3. While Roundcube has not reported any confirmed in-the-wild exploitation, the extensive nature and severity of these patched bugs underscore the urgency of immediate remediation.

What You Should Do

• Update Immediately: Administrators should upgrade their Roundcube installations to version 1.6.18 or 1.7.3, depending on their current release branch, as soon as possible.
• Review Plugin Usage: Evaluate whether the markasjunk plugin is essential for your operations. If it is not actively used or required, disable it to mitigate the associated RCE risk.
• Restrict Outbound Connections: Implement strict outbound firewall rules and network segmentation to limit the Roundcube host’s ability to initiate connections to internal services and sensitive network segments.
• Limit Internal Access: Ensure that the Roundcube server has only the necessary access to internal resources. Apply the principle of least privilege to minimize potential lateral movement paths in case of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.