Roundcube Webmail IMAP Injection and CSRF Bypass Vulnerability

A vulnerability allowing IMAP injection and Cross-Site Request Forgery (CSRF) bypass has been identified in Roundcube Webmail versions prior to 1.5.14 and 1.6.14. The issue arises from unsanitized arguments in the IMAP SEARCH command, which could be exploited during mail searches.

Impact

Exploitation of this vulnerability could lead to IMAP injection, allowing attackers to manipulate IMAP commands and potentially access or modify email data. Additionally, the CSRF bypass could be used to exploit users' sessions and perform actions on their behalf.

Reproduction

The vulnerability can be reproduced by sending an IMAP SEARCH command with unsanitized arguments, such as newlines, which could inject additional commands. This can be done through the mail search feature in Roundcube Webmail.

Remediation

Users are advised to update to Roundcube Webmail versions 1.5.14, 1.6.14, or 1.7-rc6.