Detects exposure of the Roundcube Webmail installer interface. Public access to this installer may allow attackers to reconfigure the webmail application, potentially leading to email account compromise or the disclosure of sensitive configuration details.
PoC代码[已公开]
id: roundcube-installer-exposure
info:
name: Roundcube Webmail Installer - Exposure
author: theamanrawat
severity: high
description: |
Detects exposure of the Roundcube Webmail installer interface. Public access to this installer may allow attackers to reconfigure the webmail application, potentially leading to email account compromise or the disclosure of sensitive configuration details.
reference:
- https://roundcube.net/
- https://github.com/roundcube/roundcubemail/wiki/Installation
metadata:
verified: true
max-request: 2
tags: roundcube,webmail,installer,config,misconfig,exposure
http:
- method: GET
path:
- "{{BaseURL}}/installer/"
- "{{BaseURL}}/installer/index.php?_step=2"
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains_all(body, "Roundcube Webmail Installer", "wiki/Installation", "General configuration")'
condition: and
# digest: 4a0a0047304502206e0489078982f908a384c1e6305fdf87b0ec9fbd32d47978ebe2cab1d00f70c3022100cf32aab13a6f0772dc2a159336708585105dc54b7f86bf5a769720b6370b0a2b:922c64590222798bb761d5b6d8e72950