In my security lab, I write blog posts about identified security vulnerabilities, which are published in accordance with the responsible disclosure procedure.
01.01.2024 - Rene Rehme
Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
→ 14. Okt. 2023 - The vulnerability has been identified.
→ 16. Okt. 2023 - The vulnerability was reported to RoundCube via E-Mail.
← 17. Okt. 2023 - The security vulnerability has been confirmed.
← 04. Nov. 2023 - A fix is in the works, a new version is planned for the upcoming weekend.
⚑ 05. Nov. 2023 - Security updates 1.6.5 and 1.5.6 released
→ 11. Jun. 2024 - Blog article published.
I will not disclosing detailed information about the vulnerability to prevent active exploitation. It should be noted that certain prerequisites must be met for the vulnerability to be exploited.
In a proof of concept, we have written an exploit that shows which threats this vulnerability harbours (regardless of the CVSS base score) .
The video shows how the security vulnerability is demonstratively exploited to drain emails from an email inbox by sending them in the form of chunk files to an attacker's server.
CWE-20 Improper Input Validation