hackmelocal/cve-2025-49113-simulationContainerized lab environment to simulate and exploit a post-authentication RCE vulnerability (CVE-2025-49113) in Roundcube Webmail via PHP object deserialization and gadget chains.
A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113.
This lab demonstrates a sophisticated attack chain against the Roundcube webmail client. The vulnerability is a Post-Authentication Remote Code Execution (RCE) caused by improper handling of PHP session data, leading to PHP Object Deserialization.
An authenticated attacker can craft a malicious PHP object, inject it into the server's session data through an endpoint like the image upload functionality, and then trigger its deserialization by performing a seemingly benign action, such as logging out. This forces the server to execute arbitrary code provided by the attacker.
Crypt_GPG_EngineThis repository contains a vulnerable Roundcube instance ready for you to exploit. The lab can be run instantly in the cloud or on your local machine.
This is the easiest way to get started. It provides a pre-configured, cloud-based environment in your browser.
Launch Codespace: Click the "Open in GitHub Codespaces" badge at the top of this README.
Wait for Setup: GitHub will prepare your environment. Once complete, a terminal will appear.
Start the Vulnerable Services: In the VS Code terminal, run the following single command:
docker compose up
This will start the vulnerable Roundcube instance, a mail server, and a database. You will see a "Ports" tab appear. Click the link for Port 8080 to open Roundcube in a new browser tab.
Perform the Exploit:
+ icon in the terminal panel).Run the entire lab on your own machine with Docker.
Prerequisites:
Instructions:
Clone the Repository:
git clone https://github.com/hackmelocal/CVE-2025-49113-Simulation.git
cd CVE-2025-49113-Simulation
Start the Vulnerable Services: In your terminal, run the command:
docker compose up
Access Roundcube: Open your web browser and navigate to http://localhost:9876.
Perform the Exploit: