Fullpath disclosure in roundcube webmail

[king_purba@yahoo.co.uk]

I try this request in my mailbox
http://xxxx.com/roundcube/?_auth=3Dc...3eca08d1b0bce=
&_task=3Dma%60il
then roundcube shows this warning

**PHP Error in /usr/local/apache2/htdocs/roundcube/index.php (301)*:* Invalid
request failed/file not found

The requested page was not found!
Please contact your server-administrator.

*Failed request:*
http://xxxx.com/roundcube/?_auth=3Dc...3eca08d1b0bce=
&_task=3Dma%60il

[Steven M. Christey]

>I try this request in my mailbox
>http://xxxx.com/roundcube/?_auth=3Dc...f3ba3eca08d1b0
>bce= &_task=3Dma%60il then roundcube shows this warning

For the 3 people who might care about the distinction (e.g. vuln DBs
who exclude path disclosure), this appears to be a custom error
message, not one generated by PHP, and therefore a design choice by
the developer.

Notice that in the URL above, the "_task" parameter has the value
"ma`il" - an invalid value.

roundcube appears to perform some validation of the value, then giving
a verbose error message when the validation fails.

Near the end of index.php we have:

> // only allow these templates to be included
> $valid_tasks = array('mail','settings','addressbook');
>
> // parse main template
> if (in_array($_task, $valid_tasks))
> parse_template($_task);
>
>
> // if we arrive here, something went wrong
> raise_error(array('code' => 404,
> 'type' => 'php',
> 'line' => __LINE__,
> 'file' => __FILE__,
> 'message' => "Invalid request"), TRUE, TRUE);


So __FILE__ is part of the error message, which is inserted into a
text template. The relevant code is in program/steps/error.inc and
program/include/bugs.inc.

This is based on source analysis of roundcubemail-0.1-20051021.

- Steve

[roundcube@gmail.com]

Since Roundcube is only available in Alpha version, it's pre-configured with a high verbose level. It allows you to configure wether erros should be displayed or just be logged into a file:
$rcmail_config['debug_level'] = 1;

Also the reported error is a custom message that RoundCube produces while checking the GET parameters and not a PHP generated include failure or whatever.

Regards,
Thomas