Roundcube Webmail Addresses 12 Security Vulnerabilities

Roundcube Webmail has issued crucial security updates for its 1.6 and 1.7 versions, addressing 12 vulnerabilities that posed risks of cross-site scripting (XSS), email header injection, cross-user data exposure, remote-content bypasses, and server-side request forgery (SSRF) attacks. These updates are essential for users to safeguard their servers and personal information from potential cyber threats.

Email Content and HTML Processing Flaws

The latest releases, Roundcube 1.6.19 and 1.7.4, focus on correcting issues in the email content processing, specifically concerning HTML, Cascading Style Sheets (CSS), attachment metadata, contact groups, and remote URLs. Administrators using versions 1.6.x or 1.7.x in production are strongly encouraged to apply these updates immediately to enhance security measures.

A particularly severe flaw involved a zero-click stored XSS vulnerability, which exploited TNEF MIME tags within attachment URLs. This vulnerability allowed attackers to execute malicious scripts just by the victim viewing a crafted email, without needing any interaction such as clicking links or opening attachments.

Cross-Site Scripting and Header Injection Risks

Additionally, the updates resolve another XSS issue in Roundcube’s HTML editor, which was vulnerable when processing text/enriched email content. Such vulnerabilities could enable attackers to execute JavaScript within a user’s webmail session, potentially leading to stolen session tokens, altered mailbox settings, and unauthorized actions on behalf of the user.

Email header injection vulnerabilities were also addressed, affecting fields like the subject, recipient display name, and organizational identity. These weaknesses could be exploited to manipulate email metadata or introduce unexpected headers, posing a risk if malicious inputs are not properly sanitized.

Remote Content and Cross-User Access Fixes

The update includes fixes for a cross-user access issue in SQL-based address books, which involved manipulating contact group associations. This flaw could allow unauthorized modifications of another user’s group settings, risking privacy and data integrity in shared or hosted environments.

Furthermore, multiple remote-content protections were enhanced. The fixes addressed CSS declaration smuggling, HTML body background injections, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques. These issues previously allowed bypassing of remote-content blocking features.

Roundcube also resolved a server-side request forgery bypass within its CSS proxy, addressing a flaw with hexadecimal IPv6-mapped IPv4 addresses. This vulnerability could have enabled attackers to bypass address validation, potentially accessing internal or restricted network resources.

Roundcube emphasized the importance of these updates in their release notes for the versions 1.6.19 and 1.7.4, urging all organizations with affected installations to update promptly to maintain robust security.