Roundcube Webmail Remote Image Blocking Bypass Vulnerability

A vulnerability exists in Roundcube Webmail versions prior to 1.5.14 and 1.6.14, allowing the remote image blocking feature to be bypassed. This is achieved by exploiting a crafted background attribute in the BODY element of an email message. The bypassed image blocking can lead to information disclosure or access control issues.

Impact

Exploitation of this vulnerability can bypass the remote image blocking feature, potentially leading to unauthorized information disclosure or access control violations.

Reproduction

To reproduce this vulnerability, send an email containing a BODY element with a crafted background attribute that includes data URI images. When the email is received and the background image is processed, the remote image blocking will be bypassed, allowing the images to be loaded despite the blocking feature being active.

Remediation

Users can update to Roundcube Webmail versions 1.5.14, 1.6.14, or 1.7-rc6, all of which include the necessary fix. Instructions for updating are available on the Roundcube website.