Critical Vulnerability in RoundCube Webmail Allows Remote Code Execution

What changed

A critical vulnerability has been identified in RoundCube Webmail, specifically affecting versions prior to 1.5.10 and 1.6.x before 1.6.11. This flaw allows authenticated users to exploit the application through PHP Object Deserialization, leading to potential remote code execution.

The vulnerability arises from inadequate validation of the _from parameter in the upload.php script, which can be manipulated to execute arbitrary code on the server.

Who is affected

Organizations using RoundCube Webmail versions earlier than 1.5.10 and 1.6.x prior to 1.6.11 are at risk. This includes educational institutions, businesses, and any entity relying on this webmail solution for communication.

Given the nature of the vulnerability, any authenticated user could potentially exploit it, increasing the risk of unauthorized access and data breaches.

• RoundCube Webmail (versions < 1.5.10 and < 1.6.11)
• Educational institutions using RoundCube for email services
• Businesses relying on RoundCube for internal communications
• Any organization with authenticated user access to RoundCube Webmail

What to do

It is imperative for organizations to update their RoundCube Webmail installations to the latest versions to mitigate this vulnerability. Immediate action is recommended to prevent potential exploitation.

In addition to updating, organizations should review their access controls and monitor for any unusual activity that could indicate exploitation attempts.

• Upgrade to RoundCube Webmail version 1.5.10 or 1.6.11 or later.
• Review and enhance access controls for authenticated users.
• Monitor systems for any signs of unauthorized access or exploitation.
• Implement security best practices for web applications to reduce the risk of similar vulnerabilities.