CVE-2024-37385

The vulnerability consists of insufficient validation and sanitization of paths to ImageMagick tools configured by the im_convert_path and im_identify_path parameters. An attacker can inject malicious system commands through these parameters, which are then executed by the server. The vulnerability exists due to an incomplete patch for the earlier CVE-2020-12641 vulnerability, meaning that the original protection mechanism proved insufficient in Windows environments.

An unauthenticated remote attacker can execute arbitrary system commands on the server hosting Roundcube Webmail, which may lead to complete system compromise, data theft, and violation of service integrity and availability.

Roundcube Webmail should be updated to version 1.5.7 or 1.6.7. The fix is available in official project releases on GitHub (tags 1.5.7 and 1.6.7) and in commit 5ea9f37ce39374b6124586c0590fec7015d35d7f.

Roundcube Webmail in versions before 1.5.7 and in the 1.6.x branch before 1.6.7, running on Microsoft Windows systems