Roundcube Webmail反序列化漏洞

详细信息

漏洞类型

其他

漏洞描述

Roundcube Webmail是Roundcube开源的一款基于浏览器的开源IMAP客户端，它支持地址薄管理、信息搜索、拼写检查等。Roundcube Webmail 1.5.10之前版本和1.6.11之前版本存在不安全的反序列化漏洞。漏洞源于program/actions/settings/upload.php文件对名为_from的URL参数缺乏有效的输入验证。攻击者通过构造恶意的PHP序列化对象将此Payload注入到_from参数中，其值会被恶意存入服务器的$_SESSION变量。在特定的触发点（如用户注销或会话刷新时），Roundcube的rcube_session类会调用unserialize()处理这些数据。此时，恶意对象被还原并触发预设的代码执行逻辑，从而实现 RCE。

修复建议

升级至 Roundcube 1.5.10、1.6.11或更高版本，如使用cPanel、Plesk、ISPConfig、DirectAdmin等控制面板，联系提供商确认已应用补丁。参考链接： https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 https://github.com/roundcube/roundcubemail/releases/tag/1.6.11

参考链接

• http://www.openwall.com/lists/oss-security/2025/06/02/3

  OSV · Third Party Advisory · Mailing List

• https://access.redhat.com/security/cve/cve-2025-49113

  CNNVD

• https://fearsoff.org/research/roundcube

  CVE · Third Party Advisory

• https://github.com/advisories/GHSA-8j8w-wwqc-x596

  GitHub

• https://github.com/roundcube/roundcubemail

  OSV

• https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d

  CVE · Patch

• https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695

  CVE · Patch

• https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e

  CVE · Patch

• https://github.com/roundcube/roundcubemail/pull/9865

  CVE · Issue Tracking

• https://github.com/roundcube/roundcubemail/releases/tag/1.5.10

  CVE · Release Notes

• https://github.com/roundcube/roundcubemail/releases/tag/1.6.11

  CVE · Release Notes

• https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html

  GitHub · Third Party Advisory · Mailing List

• https://nvd.nist.gov/vuln/detail/CVE-2025-49113

  CNNVD

• https://osv.dev/vulnerability/CVE-2025-49113

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49113

  OSV

• https://osv.dev/vulnerability/GHSA-8j8w-wwqc-x596

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49113

  OSV

• https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10

  CVE · Vendor Advisory

• https://security-tracker.debian.org/tracker/CVE-2025-49113

  OSV

• https://ubuntu.com/security/CVE-2025-49113

  OSV

• https://ubuntu.com/security/notices/USN-7584-1

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113

  GitHub · US Government Resource

• https://www.cve.org/CVERecord?id=CVE-2025-49113

  OSV

• https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script

  CVE · Third Party Advisory · Mitigation · Exploit

• https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection

  CVE · Third Party Advisory · Mitigation · Exploit