The Roundcube project has released versions 1.6.21 and 1.7.6 to fix 17 security flaws in its webmail software, including several injection bugs, two server-side request forgery filter bypasses and three cross-site request forgery gaps. The updates landed on Monday, November 9.
Roundcube 1.6.20 and 1.7.5 and Earlier Are Affected
The vulnerable builds are Roundcube Webmail 1.6.20 and earlier, and 1.7.5 and earlier. Administrators on either branch should move to 1.6.21 or 1.7.6 respectively. No CVE identifiers have been issued, and no active exploitation has been reported. The project is nonetheless urging immediate updates because Roundcube is a frequent target for attackers.
Injection Flaws Across Sieve, Mail Headers, HTTP and IMAP
The release fixes injection issues in four areas: Sieve scripts, mail headers, HTTP requests and IMAP commands. Injection flaws allow attacker-controlled input to be interpreted as instructions by a downstream component, and in a mail system each of these four layers handles untrusted data from messages or users.
SSRF Filter Bypasses Using nip.io and sslip.io Addresses
Two of the fixed flaws are server-side request forgery filter bypasses. They work through addresses on the nip.io and sslip.io services, which resolve hostnames to arbitrary IP addresses. An attacker can use such a name to slip past a filter meant to block internal addresses, causing the server to send requests to destinations it should not reach.
Three CSRF Gaps Include a Mail-Purging Action
The update closes three cross-site request forgery gaps, one of which could be used to purge mail. CSRF flaws let an attacker trick a logged-in user’s browser into performing actions the user did not intend, which in a webmail client can mean destructive changes to a mailbox.
Open Redirect, CPU Exhaustion and ImageMagick Attachment Handling
The remaining fixes cover an open redirect, a denial-of-service condition that exhausts CPU, and unsafe handling of attachments passed to ImageMagick. The last item concerns the way the webmail software hands uploaded or received files to an external image-processing library.
Together, the 17 fixes cover a wide range of weaknesses rather than a single critical bug. The reporting does not rank the issues by severity or assign scores, so administrators cannot yet sort the list by urgency beyond the project’s general call to update.
What Older Roundcube Builds Expose Mail Server Administrators To
Administrators running older builds are exposed to injection and forgery attacks against a service that sits in front of user mailboxes. Roundcube’s popularity as a target is the reason the project gives for its urgency, even without evidence of exploitation.
The absence of CVE numbers also limits tracking. Vulnerability scanners and asset-management tools typically key on those identifiers, so organizations may need to check their Roundcube version numbers directly against the two fixed releases rather than waiting for scanner coverage.
Version Numbers to Check on Each Roundcube Branch
Roundcube maintains two supported lines, and each received its own fix. Administrators on the 1.6 branch should reach 1.6.21, which covers 1.6.20 and everything earlier. Administrators on the 1.7 branch should reach 1.7.6, which covers 1.7.5 and everything earlier. The project has not described any workaround for staying on older builds, and the advisory material names the upgrade as the response. Because several of the fixed flaws involve content a mail server receives from outside, including headers and attachments, the exposure does not depend on a user taking any unusual action.
The 17 fixes span several categories: injection in four areas, SSRF filter bypasses, CSRF, an open redirect, CPU exhaustion and attachment handling. That breadth means the release is better read as a broad hardening update than a response to one reported attack, and the project has linked its urgency to Roundcube’s standing as a frequent attacker target.
