CVE-2017-16651 Roundcube Webmail File Disclosure
Authenticated attackers can read arbitrary files on the server via path traversal in attachment plugins, exposing sensitive configuration data.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16651?
CVE-2017-16651 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 9 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Weakness: CWE-552
Which versions are affected by CVE-2017-16651?
It affects 2 products.
Products include Debian Debian Linux, Roundcube Webmail.
How do I fix CVE-2017-16651?
Upgrade to a fixed version. US federal agencies must fix it by 3 May 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-16651 being exploited?
Yes. Attackers have exploited CVE-2017-16651 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-16651, DEBIAN-CVE-2017-16651, DLA-1193-1, DSA-4030-1, GHSA-6r67-r3jm-88p4, MGASA-2017-0409 and 2 more.