CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
Description
CVE-2021-44026 is a critical SQL injection vulnerability in Roundcube Webmail affecting versions before 1.3.17 and 1.4.x before 1.4.12. The vulnerability exists in the search and search_params functionality, where user-supplied input is incorporated into SQL queries without proper sanitization. An attacker can exploit this flaw remotely without authentication to read, modify, or delete database contents, potentially compromising all stored emails, contacts, and user credentials managed by the Roundcube Webmail instance. CISA has added CVE-2021-44026 to its Known Exploited Vulnerabilities catalog, and its EPSS score of 64.0% (98th percentile) confirms a high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| roundcube | webmail | < 1.3.17; >= 1.4.0, < 1.4.12 |
| fedoraproject | fedora | 33; 34 |
| debian | debian linux | 9.0; 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://bugs.debian.org/1000156(Mailing List, Patch)
- https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1(Patch)
- https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa(Patch)
- https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/(Mailing List, Release Notes)
- https://www.debian.org/security/2021/dsa-5013(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44026(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
In Roundcube Webmail, the search and search_params input parameters are incorporated into SQL queries without adequate sanitization or parameterization. This allows an attacker to inject malicious SQL statements that are executed against the underlying database, potentially bypassing authentication, extracting sensitive data, or modifying database records.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
Impact Analysis
CVE-2021-44026 is a remotely exploitable SQL injection vulnerability that requires no authentication and no user interaction to exploit, making it one of the most dangerous vulnerability types for web applications. With a CVSS score of 9.8 (Critical), the impact spans all three security pillars. Confidentiality (High): An attacker can extract the entire database contents, including stored emails, user credentials, address books, and configuration data. Integrity (High): SQL injection enables the attacker to modify or insert arbitrary data into the database, potentially altering email contents, user settings, or creating rogue administrator accounts. Availability (High): Through destructive SQL commands, an attacker can delete tables, corrupt data, or overload the database server, causing denial of service. The EPSS score of 64.0% (98th percentile) indicates that this vulnerability is far more likely to be exploited than the vast majority of known vulnerabilities, and its presence in the CISA KEV catalog confirms active exploitation in real-world attacks against Roundcube Webmail deployments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-44026 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. The EPSS score of 64.0% (98th percentile) underscores the high probability of exploitation activity targeting Roundcube Webmail installations with unpatched search functionality. While no dedicated public exploit with an "Exploit" tag is present in the NVD references, the patch commits on GitHub (commit c8947ecb and commit ee809bde) provide detailed diff information that significantly lowers the barrier for exploit development. Organizations running affected versions should prioritize remediation immediately.
Remediation
- Upgrade Roundcube Webmail to version 1.3.17 or later (for 1.3.x) or 1.4.12 or later (for 1.4.x) as mandated by CISA's KEV catalog directive. Apply mitigations per vendor instructions or discontinue use if patches are unavailable for your branch.
- Apply the specific patches from the Roundcube GitHub repository: commit c8947ecb and commit ee809bde address the SQL injection in the search functionality.
- Deploy a Web Application Firewall (WAF) with SQL injection detection rules to provide an additional layer of defense. Configure rules to inspect and block suspicious SQL syntax in search-related request parameters.
- Review database access logs and application logs for signs of SQL injection attempts, such as unusual query patterns, unexpected data access, or error messages indicating malformed SQL. Check for indicators of data exfiltration or unauthorized account creation.
- Ensure the database user account used by Roundcube has minimal privileges — restrict permissions to only the operations required by the application (SELECT, INSERT, UPDATE on specific tables) and avoid granting DROP, ALTER, or administrative privileges to limit the blast radius of any successful injection.
Technical Details
CVE-2021-44026 is a SQL injection vulnerability that occurs when Roundcube Webmail processes user-supplied input through the search and search_params parameters. These parameters, used for email and contact search functionality, are incorporated into SQL queries without adequate input validation, escaping, or the use of parameterized queries (prepared statements). Attack vector (Network): The vulnerability is exploitable remotely by sending crafted HTTP requests to the Roundcube search endpoint. Attack complexity (Low): SQL injection through search parameters is straightforward to exploit using standard techniques and readily available tools. Privileges required (None) and User interaction (None): The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that no authentication or user action is needed, allowing any network-accessible attacker to exploit the vulnerability. The underlying weakness (CWE-89) reflects a failure to use parameterized queries or adequate input sanitization in the database interaction layer of the search functionality.
Frequently Asked Questions
Is CVE-2021-44026 being actively exploited?
Yes, CVE-2021-44026 is confirmed to be actively exploited. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. The EPSS score of 64.0% (98th percentile) further indicates a high probability of ongoing exploitation against vulnerable Roundcube Webmail installations.
What products are affected by CVE-2021-44026?
CVE-2021-44026 affects Roundcube Webmail versions before 1.3.17 and versions 1.4.x before 1.4.12. Fedora and Debian Linux distributions that package Roundcube Webmail are also affected if running vulnerable versions.
How do I fix CVE-2021-44026?
Upgrade Roundcube Webmail to version 1.3.17 or later for the 1.3.x branch, or version 1.4.12 or later for the 1.4.x branch. Apply the vendor patches from the Roundcube GitHub repository and deploy a WAF with SQL injection detection rules for additional protection.
How severe is CVE-2021-44026?
CVE-2021-44026 is rated Critical with a CVSS score of 9.8 out of 10 under CVSS v3.1. It enables unauthenticated remote SQL injection with full impact on confidentiality, integrity, and availability. Its EPSS score in the 98th percentile means it is more likely to be exploited than the vast majority of known vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.