CVSS 9.8CRITICAL
The severity is rated as CRITICAL due to the potential for unauthorized access to highly sensitive information within government and defense organizations. Real-world exploitability is high, especially in homelab environments where security practices may be lax compared to production systems. While patches exist for many known vulnerabilities in Roundcube, their maturity and implementation vary widely. The window of exposure remains significant until all affected systems are fully patched.

APT28, also known as Fancy Bear, has been actively targeting webmail platforms to infiltrate government and defense email accounts. Roundcube, a popular open-source webmail client used by numerous organizations worldwide, has emerged as a frequent target due to its widespread deployment and history of exploitable vulnerabilities. The exploitation toolkit developed by APT28, named Operation Roundish, specifically targets Roundcube installations that have not been properly secured or updated. This campaign highlights the critical importance of maintaining up-to-date software and implementing strong security practices for webmail systems used in sensitive environments.

Affected Systems
  • Roundcube
Affected Versions: all versions before 1.5.0
Remediation
  • Upgrade to the latest version of Roundcube, specifically version 1.5.0 or higher by running `sudo apt-get update && sudo apt-get install roundcube=1.5.0`.
  • Enable and configure two-factor authentication for all user accounts in Roundcube to enhance security. Follow instructions on the official documentation: https://roundcube.net/docs/user_manual/3.2/en/
  • Review and apply any relevant patches from the Roundcube security advisories found at https://roundcube.net/announce/list/.
  • Implement strict access controls and monitor login attempts for suspicious activity.
Stack Impact

The impact on common homelab stacks is substantial, particularly for those using outdated versions of Roundcube. Systems running version 1.4.x or below are at high risk. Specific software affected includes Roundcube mail server configurations, typically found in `/etc/roundcube/config.inc`.

Source →