Roundcube Webmail rcube_image.php Remote Code Execution Vulnerability (CVE-2020-12641)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-12641) is a critical OS Command Injection vulnerability in the image processing component (rcube_image.php) of Roundcube Webmail. Roundcube utilizes external ImageMagick utilities (convert, identify) for image manipulation and verification. Due to insufficient input validation and sanitization of the im_convert_path and im_identify_path configuration settings, shell metacharacters can be injected and passed directly to the system shell, leading to arbitrary code execution.

2. Exploitation Mechanics & Attack Scenario

An attacker capable of manipulating or influencing the configuration settings can inject shell metacharacters (such as ;, &&, or |) followed by malicious payloads into the im_convert_path or im_identify_path parameters. When rcube_image.php subsequently invokes the system shell to execute the ImageMagick binary, the injected commands are executed under the security context of the web server process (e.g., www-data), allowing the attacker to establish reverse shells or deploy web shells.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability poses an active threat to enterprise infrastructures. Successful exploitation allows complete compromise of the mail server, enabling attackers to exfiltrate sensitive email data, hijack communications, and leverage the compromised server as a pivot point to compromise the internal network.