Debian DSA-6479-1: Roundcube Webmail XSS, SSRF, and Unauthenticated RCE — Detection and Patching Guide

---
title: Web Server Process Spawning Shell — Possible Roundcube RCE
id: 3f8a2c91-7b4d-4e6a-9c12-5d8f0a1b2c3d
status: experimental
description: Detects the Apache/Nginx/PHP-FPM worker process spawning command interpreters or common post-exploitation tools, consistent with unauthenticated code execution against a PHP webmail application such as Roundcube.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6479-1-roundcube
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/php-fpm8.4'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Roundcube plugins invoking external binaries (e.g., password change helpers, spam filter integration) — baseline and exclude known plugin paths
level: high
---
title: Web Shell Dropped in Roundcube Webroot
id: 9e1c4b77-2a3f-4d58-b801-6c7d9e0f1a2b
status: experimental
description: Detects creation of PHP files in web-accessible Roundcube directories by non-package-manager processes, consistent with web shell deployment following exploitation of a webmail RCE.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6479-1-roundcube
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/roundcube/'
      - '/webmail/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Roundcube package updates and plugin installations — correlate with apt/dpkg activity and maintenance windows
level: high
---
title: Outbound Connection from PHP-FPM or Web Server Process
id: 5b2d8e44-1c6a-4f93-a7d5-8e9f0b1c2d3e
status: experimental
description: Detects the web server or PHP-FPM process initiating outbound network connections, consistent with SSRF callback, reverse shell, or data exfiltration following Roundcube exploitation.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6479-1-roundcube
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/php-fpm'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/php-fpm8.4'
      - '/apache2'
  filter_ports:
    DestinationPort:
      - 80
      - 443
      - 993
      - 143
  condition: selection and not filter_ports
falsepositives:
  - Roundcube remote image fetching, plugin update checks, or external API integrations — tune against your baseline of legitimate destinations
level: medium

// Hunt: shells or LOLBins spawned by web server / PHP-FPM on mail hosts (Roundcube RCE post-exploitation)
let Lookback = 7d;
let Shells = dynamic(["/bin/sh","/bin/bash","/bin/dash","/usr/bin/python3","/usr/bin/perl","/usr/bin/curl","/usr/bin/wget","/bin/nc","/usr/bin/ncat","/usr/bin/socat"]);
let WebProcs = dynamic(["apache2","nginx","php-fpm","php-fpm8.2","php-fpm8.3","php-fpm8.4"]);
Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName in~ (WebProcs)
| where SyslogMessage has_any ("sh -c", "bash", "curl", "wget", "python", "nc ", "ncat", "socat", "/tmp/", "/dev/shm/")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc
;
// Companion hunt: outbound connections from web processes to non-mail, non-web ports (SSRF / reverse shell)
let Lookback2 = 7d;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback2)
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "nginx")
| where RemotePort !in (80, 443, 143, 993, 587, 465, 25)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP != "127.0.0.1"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| order by ConnectionCount desc

-- Hunt: suspicious PHP artifacts in Roundcube webroot and anomalous web-user processes
-- Deploy as a multi-host hunt across Debian mail servers
SELECT
    FullPath AS WebShellCandidate,
    Size AS FileSize,
    Mtime AS ModifiedTime,
    Ctime AS CreatedTime
FROM glob(
    globs=[
        '/var/lib/roundcube/**/*.php',
        '/usr/share/roundcube/**/*.php',
        '/var/www/roundcube/**/*.php',
        '/var/www/html/webmail/**/*.php',
        '/tmp/**/*.php',
        '/dev/shm/**'
    ]
)
WHERE ModifiedTime > now() - (7 * 24 * 3600)
ORDER BY ModifiedTime DESC

-- Hunt: processes running as www-data with anomalous command lines or listening sockets
SELECT
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE Username =~ 'www-data|wwwrun|nginx|apache'
  AND (
    CommandLine =~ 'sh|bash|python|perl|nc |ncat|socat|curl|wget'
    OR Exe =~ '/tmp/|/dev/shm/|/var/tmp/'
  )

#!/usr/bin/env bash
# DSA-6479-1 Roundcube patch verification and application - Debian trixie
set -euo pipefail

echo "=== [1] Current installed Roundcube version ==="
dpkg -l roundcube roundcube-core roundcube-plugins 2>/dev/null | grep '^ii' || echo "Roundcube not installed via dpkg — check for upstream/manual installs under /var/www and /usr/share"
apt-cache policy roundcube | head -n 10

echo "=== [2] Applying security update ==="
apt-get update
apt-get install --only-upgrade -y roundcube roundcube-core roundcube-plugins roundcube-mysql 2>/dev/null \
  || apt-get install --only-upgrade -y roundcube roundcube-core roundcube-plugins

echo "=== [3] Post-patch version confirmation ==="
apt-cache policy roundcube | grep -A1 'Installed'
echo "Confirm the Installed version matches the fixed release listed at https://www.debian.org/security/ (DSA-6479-1)"

echo "=== [4] Quick compromise triage: PHP files modified in last 14 days in webroot ==="
find /var/lib/roundcube /usr/share/roundcube /var/www -name '*.php' -mtime -14 -type f 2>/dev/null | while read -r f; do
    stat --format='%y %n' "$f"
done | sort -r | head -n 30

echo "=== [5] Files in world-writable temp dirs (web shell staging) ==="
find /tmp /var/tmp /dev/shm -type f \( -name '*.php' -o -name '*.py' -o -name '*.sh' -o -name '*.pl' \) 2>/dev/null

echo "=== [6] www-data-owned processes with suspicious command lines ==="
ps -u www-data -o pid,comm,args 2>/dev/null | grep -Ei 'bash|sh |python|perl|nc |ncat|socat|curl|wget' || echo "None found"

echo "=== [7] Outbound connections from PHP-FPM/apache2 to non-standard ports ==="
ss -tnp 2>/dev/null | grep -Ei 'php-fpm|apache2|nginx' | grep -Ev ':(80|443|143|993) ' || echo "None found"

echo "=== [8] Restart services to load patched PHP code ==="
systemctl restart php*-fpm.service 2>/dev/null || true
systemctl reload apache2 2>/dev/null || systemctl reload nginx 2>/dev/null || true
echo "Done. Review sections 4-7 output before declaring the host clean."