Roundcube RCE Lab (CVE-2025-49113)

A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113.

📖 About The Vulnerability

This lab demonstrates a sophisticated attack chain against the Roundcube webmail client. The vulnerability is a Post-Authentication Remote Code Execution (RCE) caused by improper handling of PHP session data, leading to PHP Object Deserialization.

An authenticated attacker can craft a malicious PHP object, inject it into the server's session data through an endpoint like the image upload functionality, and then trigger its deserialization by performing a seemingly benign action, such as logging out. This forces the server to execute arbitrary code provided by the attacker.

Key Concepts

• PHP Object Injection: The core of the attack, where a serialized PHP object is passed into the application.
• Gadget Chain: A sequence of classes and methods within the application's codebase (Crypt_GPG_Engine in this case) that can be abused by the deserialization process to perform unintended actions.
• Session Corruption: The technique used to inject the malicious object into the user's server-side session.

---

🎯 Live Simulation Lab

This repository contains a vulnerable Roundcube instance ready for you to exploit. The lab can be run instantly in the cloud or on your local machine.

Method 1: Run in GitHub Codespaces (Recommended)

This is the easiest way to get started. It provides a pre-configured, cloud-based environment in your browser.

1. Launch Codespace: Click the "Open in GitHub Codespaces" badge at the top of this README.

2. Wait for Setup: GitHub will prepare your environment. Once complete, a terminal will appear.

3. Start the Vulnerable Services: In the VS Code terminal, run the following single command:

   root@kitploit:~

   docker compose up
   

   This will start the vulnerable Roundcube instance, a mail server, and a database. You will see a "Ports" tab appear. Click the link for Port 8080 to open Roundcube in a new browser tab.

4. Perform the Exploit:

   • Open a new terminal in your Codespace (Click the + icon in the terminal panel).
   • Follow the instructions in the "🚀 How to Run the Exploit" section below.

Method 2: Run Locally

Run the entire lab on your own machine with Docker.

Prerequisites:

• Docker installed.
• Docker Compose installed.

Instructions:

1. Clone the Repository:

   root@kitploit:~

   git clone https://github.com/hackmelocal/CVE-2025-49113-Simulation.git
   cd CVE-2025-49113-Simulation
   

2. Start the Vulnerable Services: In your terminal, run the command:

   root@kitploit:~

   docker compose up
   

3. Access Roundcube: Open your web browser and navigate to http://localhost:9876.

4. Perform the Exploit:

   • Open a new, separate terminal window.
   • Follow the instructions in the next section.