CVE-2020-12641: Roundcube Webmail Remote Code Execution Vulnerability
rcubeimage.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for imconvertpath or imidentifypath.
Other sources
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for imconvertpath or imidentifypath.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.4.4 - Configuration
Ensure the configuration settings im_convert_path and im_identify_path do not allow shell metacharacters from untrusted input, since rcube_image.php in versions before 1.4.4 is vulnerable when these values include shell metacharacters.
Roundcube Webmail im_convert_path / im_identify_path = Use values that do not contain shell metacharacters (ensure these configuration paths are not attacker-controlled).
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-12641?
CVE-2020-12641 is a remote code execution vulnerability in Roundcube Webmail.
How does the CVE-2020-12641 vulnerability work?
The CVE-2020-12641 vulnerability allows attackers to execute code by using shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Which software is affected by CVE-2020-12641?
Roundcube Webmail versions 1.2.10, 1.3.11, and 1.4.4 are affected by CVE-2020-12641.
How can an attacker exploit CVE-2020-12641?
An attacker can exploit CVE-2020-12641 by injecting malicious shell metacharacters in the configuration settings for im_convert_path or im_identify_path, allowing them to execute arbitrary code.
How can I mitigate or fix the CVE-2020-12641 vulnerability?
To mitigate CVE-2020-12641, it is recommended to update Roundcube Webmail to versions 1.2.10, 1.3.11, or 1.4.4, which include security updates addressing the vulnerability.