Headline

CVE-2019-10740: Decryption Oracle based on replying to PGP encrypted emails · Issue #6638 · roundcube/roundcubemail

In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.

5 years ago

CVE

Open in Source

#vulnerability #web #oracle

In the scope of academic research in cooperation with Ruhr-Uni Bochum and FH Münster, Germany we discovered a security issue in Roundcube/Enigma: An attacker who is in possession of PGP encrypted messages can embed them into a multipart message and re-send them to the intended receiver. When the message is read and decrypted by the receiver, the attacker’s content is shown. If the victim replies, the plaintext is leaked to an attacker’s email address. The root cause for these vulnerabilities lies in the way Roundcube (and many other mail clients) handle partially encrypted multipart messages.

Leaking plaintext through replies

Attacker model: Attacker is in possession of PGP encrypted messages, which she may have obtained as passive man-in-the-middle or by actively hacking into the victim’s mail server or gateway

Attacker’s goal: Leak the plaintext by wrapping the ciphertext part within a benign-looking MIME mail sent to and decrypted+replied to by the victim

Attack outline: If Roundcube receives a multipart email, as depicted below, it decrypt the ciphertext part(s), together with the attacker-controlled text (which may be prepended and/or appended).

multipart/mixed
   |--- Attacker's part
   |--- [encrypted part]
   +--- Attacker's part

A benign-looking attacker’s text may lure the victim into replying. Because the decrypted part is also quoted in the reply, the user unintentionally acts as a decryption oracle. To obfuscate the existence of the encrypted part(s), the attacker may add a lot of newlines or hide it within a long conversation history. A user replying to such a ‘mixed content’ conversation thereby leaks the plaintext of encrypted messages wrapped within attacker-controlled text.

Countermeasures

Do not decrypt emails unless the PGP encrypted part is the root node – and therefore the only part – in the MIME tree.