Roundcube Webmail: Multiple vulnerabilities
Multiple vulnerabilities in Roundcube Webmail versions 1.6.x and 1.7.x enable remote attackers to perform arbitrary code execution, SSRF, CSRF, and denial of service.
Triage facts
Revision 1- Applicability
- Roundcube Webmail (< 1.6.21), Roundcube Webmail (< 1.7.6)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 16:33 UTC
- Source quality
- A1Likely
Multiple vulnerabilities have been identified in Roundcube Webmail, affecting versions 1.6.x prior to 1.6.21 and 1.7.x prior to 1.7.6. These vulnerabilities can allow a remote attacker to achieve arbitrary code execution, conduct Server-Side Request Forgery (SSRF), perform Cross-Site Request Forgery (CSRF), and trigger denial-of-service conditions. Security updates have been released by the vendor.
Recommendation
- Upgrade Roundcube Webmail to version 1.6.21 or 1.7.6 immediately to mitigate the identified security risks.
- Review web server access logs for anomalous POST requests or unexpected outbound connections from the web server host, which may indicate attempted exploitation of SSRF or RCE vulnerabilities.
Immediate actions
Upgrade Roundcube Webmail to 1.6.21 or 1.7.6
Threat Hunt
Hunt for anomalous outbound connections originating from the web server hosting Roundcube, potentially indicating SSRF exploitation.
Data: Firewall or Netflow logs, Web server egress telemetry
Mitigations
Patch Roundcube Webmail to versions 1.6.21 or 1.7.6
Multiple vulnerabilities including RCE, SSRF, CSRF, and DoS