CVE-2024-37385: Roundcube Webmail RCE Vulnerability

CVE-2024-37385 Overview

CVE-2024-37385 is a command injection vulnerability affecting Roundcube Webmail before version 1.5.7 and versions 1.6.x before 1.6.7 when deployed on Windows systems. The vulnerability exists in the im_convert_path and im_identify_path configuration parameters, which are used for ImageMagick integration. This issue represents an incomplete fix for CVE-2020-12641, allowing attackers to inject and execute arbitrary system commands through crafted configuration paths.

Critical Impact

This command injection vulnerability allows unauthenticated remote attackers to execute arbitrary system commands on Windows-based Roundcube installations, potentially leading to complete system compromise.

Affected Products

• Roundcube Webmail versions prior to 1.5.7
• Roundcube Webmail versions 1.6.x prior to 1.6.7
• Microsoft Windows (as the target operating system)

Discovery Timeline

• 2024-06-07 - CVE-2024-37385 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2024-37385

Vulnerability Analysis

This command injection vulnerability (CWE-77) affects the image processing functionality in Roundcube Webmail on Windows platforms. The vulnerability stems from insufficient validation of the im_convert_path and im_identify_path configuration parameters within the rcube_image.php library. When ImageMagick is configured for image manipulation, these parameters specify the paths to ImageMagick executables. On Windows systems, attackers can craft malicious path values that bypass the existing validation checks, enabling command injection through network share paths or specially formatted strings.

The issue is particularly noteworthy as it represents a bypass of the original fix implemented for CVE-2020-12641. The previous patch failed to adequately address all Windows-specific path manipulation techniques, leaving the application vulnerable to command injection via UNC paths and other Windows path formats.

Root Cause

The root cause lies in the rcube_image.php file's init() method, which performs validation on the ImageMagick executable paths. The original fix for CVE-2020-12641 attempted to prevent command injection by checking if the path begins with a backslash to block network shares. However, the validation failed to account for:

1. Forward-slash network path notation (//server/share)
2. Improper string type handling when the configuration value is null or non-string
3. Whitespace manipulation that could bypass path validation

The incomplete sanitization allowed attackers to craft paths that passed validation but ultimately executed malicious commands when processed by the system.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker targeting a vulnerable Windows-based Roundcube installation could exploit this vulnerability through:

1. Manipulating configuration settings if administrative access is obtained through other means
2. Exploiting scenarios where configuration values can be influenced through application-level attacks
3. Leveraging path manipulation techniques specific to Windows file system handling

The following patch demonstrates the security fix applied to address this vulnerability:

     {
         static $error = [];
 
-        $cmd = rcube::get_instance()->config->get($opt_name);
+        $cmd = (string) rcube::get_instance()->config->get($opt_name);
 
         if (empty($cmd)) {
             return false;
         }
 
+        $cmd = trim($cmd);
+
         if (preg_match('/^(convert|identify)(\.exe)?$/i', $cmd)) {
             return $cmd;
         }
 
         // Executable must exist, also disallow network shares on Windows
-        if ($cmd[0] != "\\" && file_exists($cmd)) {
+        if ($cmd[0] !== '\\' && strpos($cmd, '//') !== 0 && file_exists($cmd)) {
             return $cmd;
         }

Source: GitHub Commit Update

Detection Methods for CVE-2024-37385

Indicators of Compromise

• Unexpected process execution spawning from the Roundcube web application process
• Unusual network connections originating from the webmail server to external hosts
• Modifications to im_convert_path or im_identify_path configuration values in Roundcube configuration files
• Web server error logs showing failed command execution attempts with malformed paths

Detection Strategies

• Monitor web application logs for requests containing path traversal sequences or UNC path patterns
• Implement file integrity monitoring on Roundcube configuration files, particularly config.inc.php
• Deploy endpoint detection rules to identify command interpreter spawning from web server processes
• Analyze network traffic for unusual outbound connections from the Roundcube server

Monitoring Recommendations

• Enable verbose logging for the Roundcube application to capture configuration access attempts
• Implement alerting for any changes to ImageMagick-related configuration parameters
• Monitor Windows Security Event logs for process creation events linked to the web server service account
• Deploy network segmentation to limit outbound connectivity from web application servers

How to Mitigate CVE-2024-37385

Immediate Actions Required

• Upgrade Roundcube Webmail to version 1.5.7 or later for the 1.5.x branch
• Upgrade Roundcube Webmail to version 1.6.7 or later for the 1.6.x branch
• Review and validate all ImageMagick configuration paths in Roundcube settings
• Consider disabling ImageMagick integration if not required for operations

Patch Information

The Roundcube development team has released patched versions that address this command injection vulnerability. The fix ensures proper type casting of configuration values, implements whitespace trimming, and adds validation to block forward-slash UNC path notation (//) in addition to the existing backslash check.

Official releases are available:

• GitHub Release 1.5.7
• GitHub Release 1.6.7

Workarounds

• Disable ImageMagick integration by setting $config['im_convert_path'] and $config['im_identify_path'] to empty values in the Roundcube configuration
• Restrict file system permissions on the Roundcube configuration directory to prevent unauthorized modifications
• Implement web application firewall rules to filter requests containing suspicious path patterns
• Run Roundcube on Linux/Unix platforms where this specific vulnerability does not apply

# Configuration example - Disable ImageMagick integration in config.inc.php
# Add or modify these lines in your Roundcube config.inc.php
$config['im_convert_path'] = '';
$config['im_identify_path'] = '';

# Alternatively, set to absolute local paths only (after patching)
# $config['im_convert_path'] = 'C:\\ImageMagick\\convert.exe';
# $config['im_identify_path'] = 'C:\\ImageMagick\\identify.exe';