CVE-2017-16651
HIGH KEVRoundcube Webmail <1.1.10, 1.2.x <1.2.7, 1.3.x <1.3.3 - Arbitrary File Access
Title source: llmExploitation Summary
CVE-2017-16651 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 2 public exploits from researchers including ropbear, joel @ ndepthsecurity, stonepresto, thomascube, including a Metasploit module auxiliary/gather/roundcube_auth_file_read.
AI-analyzed exploit summary This Python script exploits CVE-2017-16651, a Local File Inclusion (LFI) vulnerability in Roundcube Webmail. It authenticates to the target, manipulates the timezone parameter to include arbitrary files, and retrieves the file content via a crafted request.
Description
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Exploits (2)
This Python script exploits CVE-2017-16651, a Local File Inclusion (LFI) vulnerability in Roundcube Webmail. It authenticates to the target, manipulates the timezone parameter to include arbitrary files, and retrieves the file content via a crafted request.
This Metasploit module exploits an authenticated file disclosure vulnerability in Roundcube Webmail (CVE-2017-16651) by manipulating the timezone parameter to read arbitrary files from the server's filesystem. It requires valid credentials and an active session.
References (10)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H