Executive brief
Roundcube is a widely used web-based email client. A security flaw in its Password plugin (specifically when using the DBMail driver) allows a logged-in user to execute unauthorized commands on the underlying server by including special characters in their new password. This could lead to a complete takeover of the email server and access to sensitive data.
Technical details
The vulnerability exists within the DBMail driver of the Roundcube Password plugin. When a user updates their password, the `rcube_dbmail_password::save` method in `drivers/dbmail.php` passes the unsanitized `$newpass` variable directly to a PHP `exec()` call. This call executes a helper utility, `chgdbmailusers`, which is often configured with setuid root privileges. An authenticated attacker can inject shell metacharacters (e.g., semicolons or backticks) into the password field to achieve arbitrary command execution on the host operating system, potentially with root privileges. This issue was addressed in Roundcube version 1.1.0.
Affected products
- Roundcube Roundcube Webmail Before 1.1.0
Timeline
- 2015-02-04: disclosed: Vulnerability reported to Roundcube developers
- 2015-02-08: patched: Fix committed to Roundcube repository
- 2017-01-30: advisory: NVD publication date