QID 731153

Roundcube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides functionality such as MIME support, address book, folder management, message searching and spell checking.

This vulnerability exists in the program/lib/Roundcube/rcube_string_replacer.php source file that handles linkrefs in plain text messages due to insufficient sanitization of user supplied input. An unauthenticated, remote attacker exploit this vulnerability by transmitting malicious emails containing a crafted link to load arbitrary JavaScript code. Successful exploitation could allow the attacker to execute arbitrary JavaScript code.

Affected versions:
Roundcube Webmail prior to 1.4.14
Roundcube Webmail 1.5.x before 1.5.4
Roundcube Webmail 1.6.x before 1.6.3

Detection Logic:
This unauthenticated QID detects vulnerable versions via the self-reported version string disclosed by Roundcube.

Successful exploitation allows an unauthenticated, remote attacker to gain unauthorized access, session hijacking, or the steal sensitive information by executing arbitrary JavaScript code.