Roundcube Patches Critical Zero-Click XSS, SSRF Bypass Flaws

Key Takeaways

• Roundcube Webmail has issued urgent security updates for its 1.6 LTS and 1.7 branches.
• A total of 12 vulnerabilities have been addressed, including critical zero-click XSS and SSRF bypass flaws.
• These vulnerabilities could enable cross-site scripting, email header injection, and unauthorized data access.
• All administrators of Roundcube 1.6.x and 1.7.x deployments are strongly advised to update immediately.

Roundcube Webmail Addresses Critical Vulnerabilities in Latest Updates

Roundcube Webmail has released critical security updates, versions 1.6.19 and 1.7.4, for its 1.6 LTS and 1.7 branches. These patches collectively resolve 12 vulnerabilities that could expose users and servers to a range of attacks, including cross-site scripting (XSS), email header injection, unauthorized cross-user data access, remote-content bypasses, and server-side request forgery (SSRF).

The new releases target weaknesses in how the open-source webmail platform processes various elements, such as email content, HTML, Cascading Style Sheets (CSS), attachment metadata, contact group management, and remote URLs. Organizations utilizing Roundcube 1.6.x or 1.7.x in production environments are urged to implement these updates without delay.

Zero-Click XSS Poses Significant Threat

Among the most severe issues patched is a zero-click stored cross-site scripting vulnerability. This flaw, which involves the injection of TNEF MIME tags into attachment URLs, could allow an attacker to execute malicious scripts without any user interaction.

Transport Neutral Encapsulation Format (TNEF) is a proprietary format commonly associated with Microsoft Outlook attachments. An attacker could craft a specific email that, when viewed by the victim, automatically triggers the malicious script execution, circumventing the need for the user to click links or open attachments.

Another XSS vulnerability was addressed within Roundcube’s HTML editor, specifically concerning the handling of text/enriched email content. XSS flaws are critical as they enable attackers to execute arbitrary JavaScript within a victim’s webmail session. This capability can lead to session token theft, unauthorized modification of mailbox settings, reading of private messages, or performing actions as the authenticated user.

Email Header and Data Access Flaws Corrected

Several updates focused on mitigating email header injection risks. These vulnerabilities affected critical fields such such as the subject line, the recipient’s display name, and an identity’s organization field. Improper sanitization of malicious input in these areas could allow attackers to manipulate email metadata or insert unintended mail headers.

Roundcube also fixed a cross-user access vulnerability within its SQL-based address books. This flaw could allow one user to modify the contact group associations of another user under specific conditions, potentially compromising contact privacy and the integrity of address book data in shared or multi-tenant Roundcube environments.

Remote Content and URL Validation Improvements

Multiple fixes were implemented to enhance remote-content protections. These include addressing issues like CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques that could circumvent existing remote-content blocking mechanisms.

The updates further resolve an is_local_url() validation bypass. This particular vulnerability involved fully qualified domain names with a trailing dot in stylesheet URLs. Attackers could exploit differences in URL parsing to make an external resource appear local, thereby bypassing intended security restrictions.

Finally, a server-side request forgery (SSRF) bypass was resolved in the Roundcube CSS proxy. This weakness leveraged hexadecimal IPv6-mapped IPv4 addresses, which could potentially enable an attacker to bypass address validation and compel the server to request resources from internal or otherwise restricted networks.

Roundcube has stated that comprehensive technical details are available in the release notes for versions 1.6.19 and 1.7.4. The project strongly advises all organizations operating affected Roundcube installations to apply these security updates promptly to mitigate potential risks.

What You Should Do

• Update Immediately: All administrators running Roundcube 1.6.x or 1.7.x are advised to update their installations to versions 1.6.19 or 1.7.4, respectively, as soon as possible.
• Review Release Notes: Consult the official release notes for detailed information on the patched vulnerabilities and any specific deployment considerations.
• Monitor Logs: After updating, continue to monitor server and application logs for any unusual activity that might indicate attempted exploitation of these or other vulnerabilities.
• Educate Users: While some flaws are zero-click, ongoing user education about phishing and suspicious emails remains a critical defense layer.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.