[Pkg-roundcube-maintainers] bookworm-security upload for CVE-2025-49113/roundcube
Guilhem Moulin
guilhem at debian.org
Mon Jun 2 12:45:10 BST 2025
Hi,
I'd like to propose the attached tested debdiff to fix CVE-2025-49113 in
roundcube. AFAICT neither upstream nor the reporter provided a PoC, but
a simple way to trigger the attack is to edit app.js to pass a malicious
crafted _from parameter when uploading an image. Such a request now
fails with an “Invalid input” error.
The debdiff also includes a regression fix for the CVE-2024-42009 patch.
Both patches come from upstream's release-1.6 branch.
Cheers,
--
Guilhem.
-------------- next part --------------
diffstat for roundcube-1.6.5+dfsg roundcube-1.6.5+dfsg
changelog | 9 +
patches/CVE-2025-49113.patch | 89 ++++++++++
patches/Fix-regression-where-HTML-messages-were-displayed-unstyle.patch | 54 ++++++
patches/series | 2
4 files changed, 154 insertions(+)
diff -Nru roundcube-1.6.5+dfsg/debian/changelog roundcube-1.6.5+dfsg/debian/changelog
--- roundcube-1.6.5+dfsg/debian/changelog 2024-08-12 14:59:59.000000000 +0200
+++ roundcube-1.6.5+dfsg/debian/changelog 2025-06-02 10:01:44.000000000 +0200
@@ -1,3 +1,12 @@
+roundcube (1.6.5+dfsg-1+deb12u5) bookworm-security; urgency=high
+
+ * Fix CVE-2025-49113: Post-Auth RCE via PHP Object Deserialization.
+ (Closes: #1107073)
+ * Regression fix: CVE-2024-42009.patch from 1.6.5+dfsg-1+deb12u3 and
+ 1.6.5+dfsg-1+deb12u4 caused some HTML messages to be displayed unstyled.
+
+ -- Guilhem Moulin <guilhem at debian.org> Mon, 02 Jun 2025 10:01:44 +0200
+
roundcube (1.6.5+dfsg-1+deb12u4) bookworm-security; urgency=medium
* Regression fix: The original fix for CVE-2024-42008 broke printing and
diff -Nru roundcube-1.6.5+dfsg/debian/patches/CVE-2025-49113.patch roundcube-1.6.5+dfsg/debian/patches/CVE-2025-49113.patch
--- roundcube-1.6.5+dfsg/debian/patches/CVE-2025-49113.patch 1970-01-01 01:00:00.000000000 +0100
+++ roundcube-1.6.5+dfsg/debian/patches/CVE-2025-49113.patch 2025-06-02 10:01:44.000000000 +0200
@@ -0,0 +1,89 @@
+From: Pablo Zmdl <57864086+pabzm at users.noreply.github.com>
+Date: Sun, 1 Jun 2025 09:18:54 +0200
+Subject: Validate URL parameter in upload code
+
+Origin: https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d
+Bug: https://github.com/roundcube/roundcubemail/pull/9865
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2025-49113
+Bug-Debian: https://bugs.debian.org/1107073
+---
+ program/actions/settings/upload.php | 7 +++++++
+ program/lib/Roundcube/rcube_utils.php | 16 ++++++++++++++++
+ tests/Framework/Utils.php | 19 +++++++++++++++++++
+ 3 files changed, 42 insertions(+)
+
+diff --git a/program/actions/settings/upload.php b/program/actions/settings/upload.php
+index d1cbbdc..513e5d1 100644
+--- a/program/actions/settings/upload.php
++++ b/program/actions/settings/upload.php
+@@ -32,6 +32,13 @@ class rcmail_action_settings_upload extends rcmail_action
+ $from = rcube_utils::get_input_string('_from', rcube_utils::INPUT_GET);
+ $type = preg_replace('/(add|edit)-/', '', $from);
+
++ // Validate URL input.
++ if (!rcube_utils::is_simple_string($type)) {
++ rcmail::write_log('errors', 'The URL parameter "_from" contains disallowed characters and the request is thus rejected.');
++ $rcmail->output->command('display_message', 'Invalid input', 'error');
++ $rcmail->output->send('iframe');
++ }
++
+ // Plugins in Settings may use this file for some uploads (#5694)
+ // Make sure it does not contain a dot, which is a special character
+ // when using rcube_session::append() below
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index 6811553..b5f8606 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -285,6 +285,22 @@ class rcube_utils
+ return is_string($value) ? $value : '';
+ }
+
++ /**
++ * Check if input value is a "simple" string.
++ * "Simple" is defined as a non-empty string containing only
++ * - "word" characters (alphanumeric plus underscore),
++ * - dots,
++ * - dashes.
++ *
++ * @param string $input The string to test
++ *
++ * @return bool
++ */
++ public static function is_simple_string($input)
++ {
++ return is_string($input) && !!preg_match('/^[\w.-]+$/i', $input);
++ }
++
+ /**
+ * Read request parameter value and convert it for internal use
+ * Performs stripslashes() and charset conversion if necessary
+diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
+index 4cd2750..019895b 100644
+--- a/tests/Framework/Utils.php
++++ b/tests/Framework/Utils.php
+@@ -503,6 +503,25 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+ $this->assertSame('', rcube_utils::get_input_string('test', rcube_utils::INPUT_GET));
+ }
+
++ /**
++ * rcube_utils::is_simple_string()
++ */
++ function test_is_simple_string()
++ {
++ $this->assertTrue(rcube_utils::is_simple_string('some-thing.123_'));
++ $this->assertFalse(rcube_utils::is_simple_string(''));
++ $this->assertFalse(rcube_utils::is_simple_string(' '));
++ $this->assertFalse(rcube_utils::is_simple_string('some–thing'));
++ $this->assertFalse(rcube_utils::is_simple_string('some=thing'));
++ $this->assertFalse(rcube_utils::is_simple_string('some thing'));
++ $this->assertFalse(rcube_utils::is_simple_string('some!thing'));
++ $this->assertFalse(rcube_utils::is_simple_string('%20'));
++ $this->assertFalse(rcube_utils::is_simple_string('\0000'));
++ $this->assertFalse(rcube_utils::is_simple_string(1));
++ $this->assertFalse(rcube_utils::is_simple_string(new stdClass()));
++ $this->assertFalse(rcube_utils::is_simple_string(null));
++ }
++
+ /**
+ * rcube:utils::file2class()
+ */
diff -Nru roundcube-1.6.5+dfsg/debian/patches/Fix-regression-where-HTML-messages-were-displayed-unstyle.patch roundcube-1.6.5+dfsg/debian/patches/Fix-regression-where-HTML-messages-were-displayed-unstyle.patch
--- roundcube-1.6.5+dfsg/debian/patches/Fix-regression-where-HTML-messages-were-displayed-unstyle.patch 1970-01-01 01:00:00.000000000 +0100
+++ roundcube-1.6.5+dfsg/debian/patches/Fix-regression-where-HTML-messages-were-displayed-unstyle.patch 2025-06-02 10:01:44.000000000 +0200
@@ -0,0 +1,54 @@
+From: Aleksander Machniak <alec at alec.pl>
+Date: Fri, 16 Aug 2024 19:56:51 +0200
+Subject: Fix regression where HTML messages were displayed unstyled
+
+Origin: https://github.com/roundcube/roundcubemail/commit/f343ecea09f8968d0655ff97fb7cea7a6d873a79
+Bug: https://github.com/roundcube/roundcubemail/issues/9586
+---
+ program/lib/Roundcube/rcube_washtml.php | 6 ++++++
+ tests/Actions/Mail/Index.php | 15 +++++++++++++++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
+index e9dcea4..281d369 100644
+--- a/program/lib/Roundcube/rcube_washtml.php
++++ b/program/lib/Roundcube/rcube_washtml.php
+@@ -709,6 +709,12 @@ class rcube_washtml
+ */
+ public function get_config($prop)
+ {
++ $config_props = ['html_elements', 'html_attribs', 'ignore_elements', 'void_elements', 'css_prefix'];
++
++ if (in_array($prop, $config_props)) {
++ return $this->{"_{$prop}"};
++ }
++
+ return $this->config[$prop] ?? null;
+ }
+
+diff --git a/tests/Actions/Mail/Index.php b/tests/Actions/Mail/Index.php
+index b3ae049..d3fcca2 100644
+--- a/tests/Actions/Mail/Index.php
++++ b/tests/Actions/Mail/Index.php
+@@ -422,6 +422,21 @@ class Actions_Mail_Index extends ActionTestCase
+ $this->assertSame('<html><head></head>' . $part->body . '</html>', $washed);
+ }
+
++ /**
++ * Test handling css style in HTML in wash_html() method
++ */
++ public function test_wash_html()
++ {
++ $html = '<div id="testid" class="testclass">Test</div>'
++ . '<style type="text/css">#testid .testclass { color: red; } *.testclass { font-weight: bold; }</style>';
++ $opts = ['safe' => false, 'css_prefix' => 'v1', 'add_comments' => false];
++
++ $washed = \rcmail_action_mail_index::wash_html($html, $opts);
++
++ $this->assertStringContainsString('<div id="v1testid" class="v1testclass">', $washed);
++ $this->assertStringContainsString('<style type="text/css">#v1testid .v1testclass { color: red; } *.v1testclass { font-weight: bold; }</style>', $washed);
++ }
++
+ /**
+ * Test handling of body style attributes
+ */
diff -Nru roundcube-1.6.5+dfsg/debian/patches/series roundcube-1.6.5+dfsg/debian/patches/series
--- roundcube-1.6.5+dfsg/debian/patches/series 2024-08-12 14:59:59.000000000 +0200
+++ roundcube-1.6.5+dfsg/debian/patches/series 2025-06-02 10:01:44.000000000 +0200
@@ -26,3 +26,5 @@
CVE-2024-42008.patch
Fix-regression-where-printing-scaling-rotating-image-atta.patch
CVE-2024-42010.patch
+Fix-regression-where-HTML-messages-were-displayed-unstyle.patch
+CVE-2025-49113.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20250602/0a702cb7/attachment.sig>
More information about the Pkg-roundcube-maintainers
mailing list