Back to feed
Dev.to
Dev.to
7/22/2026
Reproducing a Roundcube SSRF vulnerability: how an email can trigger internal network requests

Reproducing a Roundcube SSRF vulnerability: how an email can trigger internal network requests

Original: A letter that walks your network for you: reproducing a fresh Roundcube SSRF on a live lab

Short summary

A detailed walkthrough reproducing a critical SSRF vulnerability in Roundcube 1.6.16 where an HTML email with a stylesheet link tag tricks the server into fetching internal network addresses. The is_local_url defense function blocks direct private IPs but can be bypassed via DNS rebinding services like nip.io. The author demonstrates the full attack chain on an isolated lab and captures the server-originated request in logs.

  • •Roundcube 1.6.16 SSRF lets emails force the server to fetch internal addresses via stylesheet links
  • •The is_local_url defense blocks direct private IPs but is bypassable via nip.io DNS rebinding
  • •Full attack reproduction shown on isolated lab with log evidence

Generated with AI, which can make mistakes.

#ai-tools
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

I shipped an unauthenticated RCE in my own port scanner — here's the whole chain, and how I killed it
Dev.to
The original title is "A Rogue Registry in My Own Backyard: Anatomy of a Two-Line Supply Chain Attack"
Dev.to
The headline needs to capture: Gitea auth bypass, CVE, Docker default config issue, reproduced attack.
Dev.to
The original headline is: "Your URL-fetching service is an SSRF engine - here's the two-layer guard we shipped"
Dev.to