roundcube-webmail: Roundcube webmail

2025-08-01 roundcube-webmail PoC Public

Description

Roundcube webmail was detected.

shodan: http.component:"RoundCube"

PoC

id: roundcube-webmail

info:
  name: Roundcube webmail
  author: ritikchaddha
  severity: info
  description: |-
    Roundcube webmail was detected.
    shodan: http.component:"RoundCube"
  tags: roundcube,portal,tech
  created: 2025/06/16

rules:
  r0:
    request:
      method: GET
      path: /webmail/
    expression: |
      response.status == 200 &&
      response.body.ibcontains(b'<title>Roundcube Webmail') &&
      response.body.bcontains(b'"rcversion":')
    extractors:
      - type: regex
        extractor:
          ext1: '"\"rcversion\":(?P<webmail>[0-9]{5}),".bsubmatch(response.body)'
          webmail: ext1["webmail"]
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/fingerprinting/roundcube-webmail.yaml

References

Related Vulnerabilities