Executive brief
Roundcube is a widely used web-based email client. A security flaw in its Password plugin (specifically when using the DBMail driver) allows an authenticated user to execute malicious commands on the server. This could lead to a complete system takeover, unauthorized access to other users' emails, or a total disruption of the email service.
Technical details
The vulnerability exists within the DBMail driver of the Password plugin in Roundcube versions prior to 1.1.0. The `rcube_dbmail_password::save` function in `drivers/dbmail.php` fails to sanitize user-provided passwords before passing them to the `exec()` function, leading to OS command injection. Additionally, the `chgdbmailusers.c` helper utility, which runs with root privileges (UID 0), contains a buffer overflow vulnerability in its `strcat` operations when handling usernames or passwords exceeding 255 characters. An authenticated attacker can exploit these flaws to execute arbitrary code with root privileges on the host system. The issue is resolved in Roundcube 1.1.0.
Affected products
- Roundcube Roundcube Webmail before 1.1.0
Timeline
- 2015-02-04: disclosed: Initial report on Roundcube Trac
- 2015-02-08: patched: Fix committed to Roundcube repository
- 2017-01-30: advisory: NVD publication date