Key points
- Roundcube released versions 1.6.20 and 1.7.5 to fix multiple vulnerabilities.
- A command injection flaw exists in the _uid parameter of mail actions.
- Additional fixes address header injection, cross-site scripting, and server-side request forgery.
Roundcube developers released security updates on Oct 19 to address multiple vulnerabilities in the webmail frontend. The release includes versions 1.6.20 for the long-term support branch and 1.7.5 for the current branch, according to the oss-security mailing list. These updates are critical for administrators managing exposed webmail servers.
The most significant flaw is an IMAP command injection vulnerability. An attacker can exploit this by injecting CRLF characters into the _uid parameter within the mail/headers and mail/viewsource actions. This issue was reported by Wahab “NeoX” K. The advisory also lists fixes for header injection, cross-site scripting, and server-side request forgery flaws, though specific details for these are less elaborated in the summary.
Technical context
The advisory describes the flaw as an IMAP command injection via CRLF in the _uid parameter. It affects the mail/headers and mail/viewsource actions. The oss-security mailing list post notes that this vulnerability was reported by Wahab “NeoX” K. The source material does not specify the exact mechanism of the injection beyond the parameter and action names. It also mentions miscellaneous vulnerabilities alongside the injection and XSS/SSRF issues.
Affected versions
Organizations running Roundcube versions prior to 1.6.20 or 1.7.5 are exposed to these risks. The advisory explicitly states that these versions contain the vulnerabilities. Administrators should immediately check their installed versions against the patched releases. If a system is running an older version, it is considered vulnerable until the update is applied. No other versions are mentioned as safe in the provided material.
Next steps
Administrators must upgrade to the specified versions to mitigate these risks. The vendor has provided the patches in the recent release. Teams should schedule downtime for the update if necessary. After upgrading, verify that the new version is active and that previous configurations are intact. Monitor for any errors during the upgrade process that might indicate incompatibility with existing plugins or customizations.
Signals worth monitoring
Security teams usually look for anomalous IMAP command patterns in server logs. Check for unexpected CRLF sequences in request parameters, especially in mail header views. Look for outbound connections from the web server to unusual IPs, which might indicate server-side request forgery. Review web server access logs for requests to mail/viewsource with unusual _uid values. If suspicious activity is found, isolate the affected server and block malicious IP addresses immediately.
What to do and how to stay safe: Roundcube
- Verify your current Roundcube version and compare it to the patched releases.
- Apply the security update to version 1.6.20 or 1.7.5 as soon as possible.
- Monitor IMAP and web server logs for unusual command injection attempts.
- Review access controls to ensure only authorized users can access the webmail interface.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What versions of Roundcube are affected?
Versions prior to 1.6.20 and 1.7.5 are affected by these vulnerabilities.
Who reported the command injection flaw?
Wahab “NeoX” K. reported the IMAP command injection vulnerability.
When were the patches released?
The security updates were released on Oct 19.
