SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.
SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt
This event is generated when an attempt to exploit an IMAP command injection in RoundCube Webmail is detected. Impact: Attempted User Privilege Gain
This rule alerts on an attempt to exploit RoundCube webmail server
No public information
No known false positives
Cisco Talos Intelligence Group
Tactic: Privilege Escalation
Technique: Elevated Execution with Prompt
For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org
Command Injection
Command Injection attacks target applications that allow unsafe user-supplied input. Attackers transmit this input via forms, cookies, HTTP headers, etc. and exploit the applications permissions to execute system commands without injecting code.
CVE-2018-9846In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism. |
|
|||||||||||||||||||||||||
©2023 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
