Author Topic: Roundcube big security issue.  (Read 878 times)

0 Members and 1 Guest are viewing this topic.

Offline
*
Roundcube big security issue.
« on: July 28, 2023, 08:04:51 AM »
How do we secure these logs

https://cpanel.domain.com/roundcube/logs/errors.log
https://cpanel.domain.com/webmail/logs/errors.log

And all other files withing the logs folder.

Any one visiting above URLs (replace domain.com with your actual domain) can download these log files and use them for exploitation.

I can see there is one .htaccess file, but it's not being honoured by the cwp webserver, in my case Apache.

Offline
****
Re: Roundcube big security issue.
« Reply #1 on: July 28, 2023, 09:32:39 AM »
Just checked a couple domains.
Got either a permission denied by cwpsrv or a 403.

Hop into the CLI via SSH or Terminal

cd /scripts
./mail_roundcube_update
exit


Then in CWP, goto User Accounts -> Fix Permissions

Select the user (domain)
Check -> Fix Permissions
Check -> Internal Server Error

Offline
*
Re: Roundcube big security issue.
« Reply #2 on: July 28, 2023, 04:31:03 PM »
yup confirm

Offline
*
Re: Roundcube big security issue.
« Reply #3 on: July 28, 2023, 08:34:40 PM »
Just checked a couple domains.
Got either a permission denied by cwpsrv or a 403.

Hop into the CLI via SSH or Terminal

cd /scripts
./mail_roundcube_update
exit


Then in CWP, goto User Accounts -> Fix Permissions

Select the user (domain)
Check -> Fix Permissions
Check -> Internal Server Error

Followed above suggestion to the letter, but no use.

Some additional info.

Quote
cd /scripts
./mail_roundcube_update
Last metadata expiration check: 0:13:24 ago on Sat Jul 29 01:45:42 2023.
Dependencies resolved.
Nothing to do.
Complete!


###############################
Roundcube is already up-to-date
###############################

AlmaLinux release 8.8
CWPpro version: 0.9.8.1160

Offline
*
Re: Roundcube big security issue.
« Reply #4 on: July 28, 2023, 08:52:22 PM »
Some additional information

This too is not secure
https://host.domain.com:2031/roundcube/logs/errors.log

And is this Owner/Group correct? Because whatever domain is used, same errors.log get downloaded.
Quote
Owner: cwpsvc
Group: cwpsvc
/usr/local/cwpsrv/var/services/roundcube/logs/errors.log

And this is happening in multiple servers, not just one.

Offline
****
Re: Roundcube big security issue.
« Reply #5 on: July 28, 2023, 10:17:10 PM »
cd /scripts
./mail_roundcube_update
Note that you don't want to do this if you've manually updated to roundcube 1.5.3 per Sandeep's instructions. The "logic" of the roundcube update script does not take into account the currently installed version and will merrily blow away a newer 1.5.x install and install 1.4.11 instead.

Offline
*
Re: Roundcube big security issue.
« Reply #6 on: July 28, 2023, 11:17:19 PM »
cd /scripts
./mail_roundcube_update
Note that you don't want to do this if you've manually updated to roundcube 1.5.3 per Sandeep's instructions. The "logic" of the roundcube update script does not take into account the currently installed version and will merrily blow away a newer 1.5.x install and install 1.4.11 instead.

Thanks for the heads up, but mine is default setup, webmail is running fine.

As per my earlier post result of
cd /scripts
./mail_roundcube_update
Was
Roundcube is already up-to-date

Current version is
Roundcube Webmail IMAP Client
Version 1.4.11

And these URLs are not secure, all servers are exposed.
https://cpanel.domain.com/roundcube/logs/errors.log
https://cpanel.domain.com/webmail/logs/errors.log

https://host.domain.com:2031/roundcube/logs/errors.log
https://webmail.domain.com//logs/errors.log

Entry in /usr/local/cwpsrv/var/services/roundcube/logs/.htaccess

# deny webserver access to this directory
<ifModule mod_authz_core.c>
    Require all denied
</ifModule>
<ifModule mod_authz_core.c>
    Deny from all
</ifModule>

Owner & group for /usr/local/cwpsrv/var/services/roundcube/logs/ and all files within.
Owner: cwpsvc
Group: cwpsvc