Roundcube Webmail SVG Content Remote Image Blocking Bypass Vulnerability

A vulnerability exists in Roundcube Webmail versions prior to 1.5.15 and 1.6.15, allowing the remote image blocking feature to be bypassed using SVG content in email messages. This could lead to information disclosure or an access-control bypass. The issue involves the 'animate' element with the 'attributeName' values of 'fill', 'filter', or 'stroke'.

Impact

Exploitation of this vulnerability could result in unauthorized remote image loading, potentially leading to information disclosure or an access-control bypass.

Reproduction

To reproduce this vulnerability, send an email containing SVG content with an 'animate' element that includes 'attributeName' values of 'fill', 'filter', or 'stroke'. When the email is received, the SVG animation will bypass the remote image blocking feature, allowing the external image to be loaded despite the user's settings.

Remediation

Users can update to Roundcube Webmail versions 1.5.15, 1.6.15, or 1.7-rc6, all of which include the necessary fix. Instructions for updating are available on the Roundcube website.