Roundcube Webmail 1.7.1 Security Advisory: XSS, SQLi, SSRF, and RCE Fixes

Roundcube Webmail 1.7.1 Security Update Summary Vulnerability Overview Roundcube Webmail 1.7.1 is a security update release that addresses multiple recently reported security vulnerabilities, including XSS, SQL injection, SSRF, arbitrary file deletion, code injection, and more. Affected Scope Roundcube Webmail 1.7.x stable versions All deployment environments using affected versions Fixes 1. Fix for stored XSS/HTML/CSS injection: In the subject field of the draft recovery dialog (reported by zazy) 2. Fix for CSS injection bypass: In the HTML sanitizer via SVG (reported by wooseokdokim) 3. Fix for pre-authentication SQL injection: In the virtuser_query plugin via preg_replace backslash escape bypass (reported by skull) 4. Fix for SSRF bypass: Via specific local address URLs (reported by Orange Cyberdefense Vulnerability Disclosure Team) 5. Fix for local/private URL fetch bypass: When remote resources are not allowed (reported by Orange Cyberdefense Vulnerability Disclosure Team) 6. Fix for remote image blocking bypass: Via CSS var() (reported by Geame) 7. Fix for pre-authentication arbitrary file deletion: Via redis/memcache session poisoning bypass (reported by valent1) 8. Fix for code injection vulnerability: Removal of code evaluation support for LDAP autovalue options (reported by Glendaenri) Recommendations It is recommended to upgrade all production environments to Roundcube 1.7.x Please back up data before upgrading Other Changes Enigma: Support for automatic public key lookup (import) via HKP v1 protocol ManageSieve: Fix for errors when email messages contain duplicate List-id headers Clarified Elastic installation instructions Added HTMLFormElement.requestSubmit() polyfill for older browsers "has:attachment" search now uses $hasAttachments and $hasAttachmentKeywords Potential overly long values in IMAP ID command Fix for redis/memcache disconnection issues Static assets (such as skin_logo) can be placed in the public_html directory Use REQUEST_URI as a fallback when PATH_INFO is not set Removed assets_path functionality and dependency on PATH_INFO MySQL upgrade support for MySQL < 8.0 and MariaDB < 10.5 Fix for CSS injection bypass (SVG ) Fix for pre-authentication SQL injection (virtuser_query plugin) Fix for SSRF bypass (specific local address URLs) Fix for remote image blocking bypass (CSS var()) Fix for local/private URL fetch bypass (when remote resources are not allowed) Fix for pre-authentication arbitrary file deletion (redis/memcache session poisoning) Fix for code injection vulnerability (removal of code evaluation support for LDAP autovalue options)

Goal Reached Thanks to every supporter — we hit 100%!

Roundcube Webmail 1.7.1 Security Advisory: XSS, SQLi, SSRF, and RCE Fixes

More from this source