CVE-2020-12641 Roundcube Webmail Remote Code Execution

What is CVE-2020-12641?

CVE-2020-12641 is a critical command injection vulnerability in Opensuse Backports Sle, published on 4 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Weakness: CWE-78

Which versions are affected by CVE-2020-12641?

1 open source package ship an affected version, including roundcube. It affects 3 products.

Products include Opensuse Backports Sle, Opensuse Leap, Roundcube Webmail.

How do I fix CVE-2020-12641?

Upgrade roundcube to a fixed version for your release line: 1.2.10, 1.3.11 or 1.4.4. US federal agencies must fix it by 13 Jul 2023.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-12641 being exploited?

Yes. Attackers have exploited CVE-2020-12641 in the wild since at least 22 Jun 2023.

Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.

Other vulnerabilities in Opensuse Backports Sle

• CVE-2020-12640 Path traversal in n/a Critical 9.8
• CVE-2020-8233 Command injection in EdgeSwitch firmware v1.9.0 and prior High 8.8
• CVE-2020-8026 inn: non-root owned files High 8.4
• CVE-2020-15229 Path traversal and files overwrite with unsquashfs High 8.2
• CVE-2019-5164 Command injection in Shadowsocks High 7.8

All Opensuse Backports Sle vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-roundcube-2020-12641, DEBIAN-CVE-2020-12641, GHSA-q9jx-pp2v-v8xh, UBUNTU-CVE-2020-12641.