IMAP Command Injection in Roundcube Webmail

Executive Summary

This vulnerability is an IMAP command injection flaw in Roundcube Webmail versions before 1.6.20 and 1.7.5. A remote authenticated attacker can inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Roundcube Webmail versions for 1.6.x below 1.6.20 or 1.7.x below 1.7.5. Use commands like 'grep -r "1.6.19\|1.7.4" /path/to/roundcube/' to identify vulnerable versions. Monitor logs for IMAP command injection attempts in mail/headers or mail/viewsource actions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute unauthorized IMAP commands, potentially accessing or modifying email data, sending unauthorized emails, or performing other actions within the email system.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Roundcube Webmail to version 1.6.20 or 1.7.5 or later. Disable affected actions if updates are not possible. Review server logs for suspicious IMAP commands or CRLF injection attempts. Apply input validation patches if custom code exists.

Useful 0 Not Useful 0