Canadian Centre for Cyber Security warns of Roundcube vulnerability exploitation

Roundcube: Roundcube is a popular open source webmail client used by organizations and individuals for accessing email through a web interface. It includes plugins like virtuser_query that handle email address resolution and database interactions. The project recently addressed a high-severity SQL injection flaw in this plugin that threat actors are now actively exploiting in the wild. Omar Ahmed: Omar Ahmed serves as information security lead at Paymob, focusing on identifying and mitigating software vulnerabilities in enterprise environments. He has analyzed the Roundcube flaw and noted that successful exploitation enables attackers to tamper with database operations and access sensitive user information including messages and address books. Canadian Centre for Cyber Security: The Canadian Centre for Cyber Security is a government agency responsible for monitoring and responding to cyber threats affecting Canadian systems and organizations. It issued a public warning this week about ongoing exploitation of a critical vulnerability in Roundcube webmail. The alert highlights the risk to internet-facing servers without providing specific attack details. Exploitation: Threat actors are actively exploiting the unauthenticated SQL injection vulnerability in Roundcube's virtuser_query plugin. Patch Status: Roundcube released patches for the issue in versions 1.6.16 and 1.7.1 during late May. Historical Targeting: Roundcube servers have been frequently targeted by threat actors in prior incidents involving similar vulnerabilities.