CVE-2020-12640: Roundcube Webmail Local File Inclusion
Summary
CVE-2020-12640: Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. Affects roundcube across 3 version ranges.
>= 1.2.0, < 1.2.10
>= 1.3.0, < 1.3.11
>= 1.4.0, < 1.4.4
Fixed in 1.2.10, 1.3.11 or 1.4.4, depending on the release line you run. How to fix ↓
Also tracked for
- roundcube · Debian:11
The same CVE-2020-12640 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Roundcube Webmail is an open-source web-based email client that provides a user-friendly interface for accessing and managing emails. It is widely used by individuals and organizations as a self-hosted email solution. However, a vulnerability has been discovered in Roundcube Webmail versions prior to 1.4.4 that allows attackers to include local files and execute arbitrary code through directory traversal in a plugin name to rcube_plugin_api.php.
Vulnerability Detail
The vulnerability arises from insufficient input validation in the handling of plugin names in the rcube_plugin_api.php file. By exploiting this flaw, an attacker can manipulate the plugin name parameter to traverse directories and include arbitrary local files. This can lead to the execution of malicious code within the context of the web server, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability has been assigned a CVSSv3 severity score of 9.8 (Critical).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.2.0, < 1.2.101.2.10 -
>= 1.3.0, < 1.3.111.3.11 -
>= 1.4.0, < 1.4.41.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the affected plugin or removing it from the Roundcube Webmail installation. This can be done by accessing the plugin configuration files and commenting out or removing the corresponding entry. However, it is important to note that this workaround may impact the functionality of the plugin and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
In conclusion, Roundcube Webmail versions prior to 1.4.4 are vulnerable to a critical local file inclusion vulnerability. To protect against potential exploitation, users should upgrade to the latest version of Roundcube Webmail or apply the provided workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for roundcube →
FAQ
Roundcube Webmail is an open-source web-based email client that allows users to access and manage their emails through a web browser.
Versions of Roundcube Webmail prior to 1.4.4 are vulnerable to this local file inclusion vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Roundcube Webmail installation is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any known vulnerabilities.
Exploiting this vulnerability can allow an attacker to include local files and execute arbitrary code within the context of the web server. This can lead to unauthorized access, data leakage, and potential compromise of the affected system.
Yes, a fix has been released in Roundcube Webmail version 1.4.4. It is recommended to upgrade to this version or later to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for roundcube.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
