CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability
Description
CVE-2017-16651 is a high-severity file disclosure vulnerability affecting Roundcube Webmail. The vulnerability allows authenticated users to access arbitrary files on the host filesystem, including sensitive configuration files, due to insufficient input validation in conjunction with file-based attachment plugins. This file disclosure vulnerability was exploited in the wild in November 2017. CISA has added CVE-2017-16651 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 37.82% (97.1st percentile), there is a significant probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | <= 1.1.9; 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; 1.2.6; 1.3.0; 1.3.1; 1.3.2 |
| debian | debian linux | 7.0; 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/101793(Third Party Advisory, VDB Entry)
- https://github.com/roundcube/roundcubemail/issues/6026(Issue Tracking, Patch, Third Party Advisory)
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.10(Issue Tracking, Release Notes, Third Party Advisory)
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.7(Issue Tracking, Release Notes, Third Party Advisory)
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.3(Issue Tracking, Release Notes, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html(Mailing List, Third Party Advisory)
- https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10(Issue Tracking, Vendor Advisory)
- https://www.debian.org/security/2017/dsa-4030(Issue Tracking, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651(US Government Resource)
Weakness Type
CWE-552: Files or Directories Accessible to External Parties
Roundcube Webmail fails to properly restrict file access through its attachment handling mechanism. The insufficient input validation in the _task=settings&_action=upload-display&_from=timezone request path allows authenticated attackers to traverse directories and access files outside the intended scope, exposing configuration files and other sensitive data on the host filesystem.
Learn more: CWE-552 — Files or Directories Accessible to External Parties
Impact Analysis
CVE-2017-16651 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a significant threat that requires prompt attention. While the attack vector is local and requires low-level authentication (the attacker must have valid credentials to the Roundcube instance), the attack complexity is low and no user interaction is required once authenticated. Successful exploitation results in high impact across all three dimensions: confidentiality, integrity, and availability. An attacker can read arbitrary files including database credentials, API keys, and email content stored on the server. With an EPSS score of 37.82% (97.1st percentile), this vulnerability has a substantial probability of exploitation, particularly in environments where Roundcube is exposed to the internet with weak or compromised user credentials.
Exploit Maturity
CVE-2017-16651 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and it was exploited in the wild as early as November 2017. Public exploit code is available via Packet Storm Security, providing a ready-to-use proof of concept that lowers the barrier for attackers. The EPSS score of 37.82% (97.1st percentile) indicates a substantial probability of exploitation. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade Roundcube Webmail to version 1.1.10, 1.2.7, or 1.3.3 (or later) depending on your installed branch.
- Verify that all instances of Roundcube Webmail have been updated beyond the affected versions: versions <= 1.1.9, 1.2.0 through 1.2.6, and 1.3.0 through 1.3.2 are all vulnerable.
- If immediate patching is not possible, review and restrict the file-based attachment plugins configuration, and consider disabling the upload-display functionality in the settings action handler until patches can be applied.
- Audit server logs for suspicious requests matching the pattern _task=settings&_action=upload-display&_from=timezone, which may indicate exploitation attempts. Review file access logs for unauthorized reads of configuration files such as config.inc.php.
- Implement defense-in-depth measures including restricting filesystem permissions on sensitive configuration files, deploying a web application firewall (WAF) with rules to detect path traversal patterns, and enforcing strong authentication policies to reduce the risk of credential compromise.
Technical Details
CVE-2017-16651 exploits insufficient input validation in Roundcube Webmail's file-based attachment plugin handling. The vulnerability is triggered through specially crafted requests to the _task=settings&_action=upload-display&_from=timezone endpoint, where user-controlled input is inadequately sanitized before being used in file system operations. This allows an authenticated user to manipulate file path references to access arbitrary files on the host filesystem, including the Roundcube configuration file (which contains database credentials) and other sensitive server files. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that while local access with valid credentials is needed, the exploitation is straightforward once authenticated. The file-based attachment plugins, which are enabled by default in Roundcube Webmail, serve as the attack surface for this vulnerability.
Frequently Asked Questions
Is CVE-2017-16651 being actively exploited?
Yes. CVE-2017-16651 is listed in the CISA Known Exploited Vulnerabilities catalog and was exploited in the wild starting November 2017. The EPSS score of 37.82% (97.1st percentile) indicates a substantial exploitation probability.
What products are affected by CVE-2017-16651?
CVE-2017-16651 affects Roundcube Webmail versions <= 1.1.9, versions 1.2.0 through 1.2.6, and versions 1.3.0 through 1.3.2. Debian Linux 7.0 and 9.0 distributions that include vulnerable Roundcube packages are also affected.
How do I fix CVE-2017-16651?
Upgrade Roundcube Webmail to version 1.1.10, 1.2.7, or 1.3.3 or later. If immediate patching is not possible, restrict access to the file-based attachment plugin functionality and audit logs for exploitation indicators.
How severe is CVE-2017-16651?
CVE-2017-16651 has a CVSS 3.1 score of 7.8 (HIGH). While it requires valid authentication, the exploitation is straightforward and can expose sensitive configuration data, making prompt patching essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.