Roundcube Webmail CSS Injection Vulnerability

A CSS injection vulnerability has been identified in Roundcube Webmail versions prior to 1.5.13 and 1.6 through 1.6.13. The issue arises from improper handling of comments, which can be exploited to inject malicious styles.

Impact

Exploitation of this vulnerability allows for CSS injection, which could be used to manipulate the appearance of the webmail interface or potentially exploit other vulnerabilities, such as the previously reported remote image blocking bypass via SVG content.

Reproduction

The vulnerability can be reproduced by uploading a CSS style that includes comments. The 'mod_css_styles' function in 'rcube_utils.php' can be used to test the injection. After the comments are removed, any remaining CSS comments are treated as a sign of a potential injection, indicating that the vulnerability exists.

Remediation

Users are advised to update to Roundcube Webmail versions 1.5.13 or 1.6.13.