Roundcube has released versions 1.6.20 and 1.7.5 of its open-source webmail client, fixing 20 security issues that include IMAP command injection, mail header injection, cross-site scripting, server-side request forgery and cross-site request forgery. The project says it strongly recommends updating all production installations.
The 20 Security Fixes in Roundcube 1.6.20 and 1.7.5
The releases came out on October 19. They cover the Roundcube Webmail 1.6.x line before 1.6.20 and the 1.7.x line before 1.7.5. The 20 fixes span five categories of weakness: IMAP command injection, mail header injection, XSS, SSRF and CSRF. Roundcube has not yet assigned CVE identifiers or severity scores to the flaws. No exploitation and no public proof-of-concept code has been confirmed.
IMAP Command Smuggling Through the _uid and _flag Parameters
Two of the bugs let an attacker smuggle additional IMAP commands into a session. They do so by inserting line-break characters into the _uid and _flag parameters. IMAP is the protocol Roundcube uses to talk to the mail server, so injected commands would reach the mailbox backend through the webmail application rather than through the mail client’s normal operations.
Four Mail Header Injection Flaws Affect the From Name, Subject and Other Fields
Four further flaws allow mail header injection. They affect fields that include the sender’s From name and the message subject. Header injection lets an attacker alter the headers of an outgoing message by embedding extra content in a field that should hold a single value.
Remote-Content Blocking and CSS Scoping Bypasses in HTML Messages
Three of the fixes address bypasses of the protections Roundcube applies to HTML email. Two of the protections involved are remote-content blocking and CSS scoping. Remote-content blocking exists to stop a message from loading images and other resources from outside servers without the user’s consent. CSS scoping limits the reach of styles in a message so they cannot alter the rest of the webmail interface. A bypass of either gives a crafted message more control over how it renders and what it can load in the reader’s session.
The remaining fixes in the set cover the XSS, SSRF and CSRF issues named in the release.
Roundcube’s Update Guidance for 1.6.x and 1.7.x Installations
Roundcube says it strongly recommends updating all production installations to 1.6.20 or 1.7.5, depending on the release line in use. The project has not published exploitation details or CVE-level scoring alongside the release, so administrators have only the category descriptions to judge urgency.
Why the Exposed Roundcube Install Base Raises the Stakes
Roundcube is a frequent attacker target, and the number of exposed servers is large. In September, Canada’s Cyber Centre warned that a separate Roundcube SQL injection flaw was under active exploitation. Shadowserver counted more than 523,000 exposed Roundcube instances at that time. The new release addresses different flaws, but the earlier warning shows how quickly attackers move on webmail software once a weakness becomes known.
Webmail servers sit in a sensitive position. They hold user mailboxes, handle credentials and face the internet, which makes injection flaws in how they talk to the mail server more consequential than a comparable bug in a standalone application. The lack of CVE identifiers for these 20 fixes also complicates tracking, since scanners and asset inventories that key on CVE numbers will not flag outdated installations until identifiers are assigned. Administrators who delay the update leave that gap open alongside the flaws themselves. Roundcube describes the update as strongly recommended for every production installation, which covers both the 1.6.x and 1.7.x lines, and the project has said nothing about workarounds for administrators who cannot upgrade immediately.
