RoundCube up to 1.2.2 sendmail.inc mail privileges management

Summaryinfo

A vulnerability categorized as problematic has been discovered in RoundCube up to 1.2.2. Impacted is the function mail of the file program/steps/mail/sendmail.inc. Such manipulation leads to privileges management. The attack may be performed from remote. In addition, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in RoundCube up to 1.2.2 (Mail Client Software). Affected by this issue is the function mail of the file program/steps/mail/sendmail.inc. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The weakness was presented 12/06/2016 by Martin Bednorz as Roundcube 1.2.2: Command Execution via Email as confirmed mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release was coordinated in cooperation with the vendor. The attack may be launched remotely. The successful exploitation needs a simple authentication. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

In Roundcube 1.2.2, and earlier, user-controlled input flows unsanitized into the fifth argument of a call to PHP's built-in function mail() which is documented as security critical. The problem is that the invocation of the mail() function will cause PHP to execute the sendmail program. The fifth argument allows to pass arguments to this execution which allows a configuration of sendmail. Since sendmail offers the -X option to log all mail traffic in a file, an attacker can abuse this option and spawn a malicious PHP file in the webroot directory of the attacked server. The following code lines trigger the vulnerability.

A public exploit has been developed by Martin Bednorz and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.2.3 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Mail Client Software

Name

• RoundCube

Version

• 1.2.0
• 1.2.1
• 1.2.2

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion