CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
Description
CVE-2020-12641 is a critical OS command injection vulnerability in Roundcube Webmail before version 1.4.4. The flaw exists in rcube_image.php, where the im_convert_path and im_identify_path configuration settings are passed to shell commands without proper sanitization, allowing attackers to inject and execute arbitrary operating system commands. Successful exploitation grants an attacker full control over the underlying server, including the ability to read and modify data, install malware, or pivot to other systems. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has an exceptionally high EPSS score of 93.1% (99th percentile), indicating near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | >= 1.2.0, < 1.2.10; >= 1.3.0, < 1.3.11; >= 1.4.0, < 1.4.4 |
| opensuse | backports sle | 15.0 |
| opensuse | leap | 15.1; 15.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html(Mailing List, Third Party Advisory)
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube(Exploit, Third Party Advisory)
- https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3(Patch)
- https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4(Release Notes)
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.4(Release Notes)
- https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10(Release Notes, Vendor Advisory)
- https://security.gentoo.org/glsa/202007-41(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12641(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
In Roundcube Webmail, the rcube_image.php component constructs OS-level commands using configuration values for im_convert_path and im_identify_path without neutralizing shell metacharacters. This allows an attacker who can influence these configuration settings to inject arbitrary commands that are executed by the server's operating system with the privileges of the web server process.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2020-12641 is a remotely exploitable command injection vulnerability that requires no authentication and no user interaction, making it trivially exploitable once the attack vector is understood. With a CVSS score of 9.8 (Critical), this vulnerability poses the highest level of risk to affected Roundcube Webmail installations. Confidentiality (High): An attacker can read any data accessible to the web server process, including email databases, configuration files containing credentials, and other sensitive server-side information. Integrity (High): Arbitrary command execution allows the attacker to modify files, alter email content, plant backdoors, and tamper with system configurations. Availability (High): The attacker can disrupt service operations by terminating processes, corrupting data, or consuming system resources. The EPSS score of 93.1% places this vulnerability in the 99th percentile, signifying near-certain exploitation, and its inclusion in the CISA KEV catalog confirms active exploitation in the wild.
Exploit Maturity
Public exploit code is available for CVE-2020-12641 via DrunkenShells on GitHub, providing a detailed disclosure and proof-of-concept that demonstrates command injection through the im_convert_path and im_identify_path configuration settings. CISA has confirmed active exploitation in the wild by including this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. The EPSS score of 93.1% (99th percentile) indicates near-certain exploitation activity, reflecting widespread targeting of unpatched Roundcube Webmail installations. Organizations running Roundcube Webmail versions prior to 1.4.4 should assume they are at imminent risk of compromise.
Remediation
- Upgrade Roundcube Webmail to version 1.4.4 or later immediately, as recommended by the vendor and CISA. Security updates are also available for the 1.3.x branch (1.3.11) and 1.2.x branch (1.2.10). See the vendor security advisory for details.
- Review and harden the im_convert_path and im_identify_path configuration settings in your Roundcube configuration file. Ensure these values point to absolute paths of legitimate ImageMagick binaries and cannot be modified by untrusted users or through the web interface.
- Restrict network access to the Roundcube Webmail administration interface using firewall rules or reverse proxy configurations. Limit access to trusted IP addresses to reduce the attack surface for configuration manipulation.
- Audit server logs for signs of compromise, including unusual process execution, unexpected outbound network connections, or modifications to system files. Check web server access logs for requests targeting rcube_image.php with suspicious parameters.
- Apply the principle of least privilege by running the Roundcube web server process under a dedicated user account with minimal file system and network permissions, limiting the impact of any successful command injection.
Technical Details
CVE-2020-12641 exploits a command injection flaw in rcube_image.php within Roundcube Webmail. The component constructs shell commands using the im_convert_path and im_identify_path configuration values to invoke ImageMagick utilities for image processing. When these configuration settings contain shell metacharacters (such as semicolons, backticks, or pipe operators), the unsanitized values are passed directly to shell execution functions, allowing arbitrary OS command injection. Attack vector (Network): The vulnerability is exploitable remotely over the network without requiring physical access. Attack complexity (Low): Exploitation requires only the ability to inject metacharacters into the configuration settings, which can be accomplished through various attack scenarios depending on the deployment. Privileges required (None) and User interaction (None): The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that no prior authentication or user action is needed, making this a fully unauthenticated remote code execution vulnerability with complete impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2020-12641 being actively exploited?
Yes, CVE-2020-12641 is actively exploited in the wild. CISA has confirmed this by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. The EPSS score of 93.1% (99th percentile) further indicates near-certain exploitation activity targeting vulnerable Roundcube Webmail installations.
What products are affected by CVE-2020-12641?
CVE-2020-12641 affects Roundcube Webmail versions before 1.4.4. Additionally, openSUSE Backports SLE and openSUSE Leap distributions that package vulnerable versions of Roundcube Webmail are affected.
How do I fix CVE-2020-12641?
Upgrade Roundcube Webmail to version 1.4.4 or later immediately. Security patches are also available for the 1.3.x branch (version 1.3.11) and 1.2.x branch (version 1.2.10). After upgrading, review and harden the im_convert_path and im_identify_path configuration settings and restrict administrative interface access.
How severe is CVE-2020-12641?
CVE-2020-12641 is rated Critical with a CVSS score of 9.8 out of 10 under CVSS v3.1. It allows unauthenticated remote code execution with full impact on confidentiality, integrity, and availability. Its EPSS score in the 99th percentile makes it one of the most likely vulnerabilities to be exploited.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.