Roundcube SSRF flaw lets incoming emails probe internal networks via mail server

·1 views

A security researcher reproduced a server-side request forgery (SSRF) vulnerability in Roundcube webmail by setting up the affected version on an isolated lab environment. The flaw, patched in Roundcube release 1.6.17 in July 2026, allows a specially crafted HTML email to make the mail server silently fetch internal network addresses without user interaction. NIST scored the vulnerability a perfect 10.0, while MITRE assigned it a 7.2, reflecting differing assessments of exploitability. The root cause lies in Roundcube's CSS sanitization feature, where the server itself fetches external stylesheets referenced in emails before passing them to the browser. The researcher confirmed the attack by capturing the outbound request in server logs, demonstrating that the existing local-URL check could be bypassed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Java Packages Explained: How Namespaces Keep Large Codebases Organised

Java packages are namespace mechanisms that group related classes, interfaces, and enums into a folder-like structure, preventing naming collisions and improving code organisation. Without packages, two classes sharing the same name — whether written by the developer or imported from a library — would cause compiler conflicts, while packages allow both to coexist under distinct identifiers. Packages also enable package-private access control, letting developers hide implementation details from outside code while keeping them visible to related classes within the same package. Java convention recommends using reverse domain names in all lowercase for package naming, such as com.example.billing, with each dot corresponding to a physical directory on disk. Placing classes in the default package — what Java assigns when no package is declared — is discouraged for real applications, as such classes cannot be imported by classes residing in named packages.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Developer Spends 16 Months Building All-in-One SaaS Tool for Freelancers

A solo developer has launched LaizyNote after 16 months of work alongside client projects, creating an all-in-one business operating system for freelancers and solo entrepreneurs. The platform combines notes, tasks, time tracking, contacts, invoicing, and an AI assistant in a single interface, addressing what the developer identified as a gap in the market. A standout feature called Business Insights uses existing project and revenue data to surface metrics like real hourly rates, client health, and portfolio concentration risks. Built on Firebase with EU hosting, the app enforces strict server-side access controls to safely handle both personal and shared team workspaces. The developer notes that the final 10% of polish — covering edge cases, localisation across six languages, and subtle UI bugs — proved far more time-consuming than building core features.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tiered Proxy Strategy Cuts Web Scraping Costs by Up to 90% Without Losing Data

A software engineer writing on DEV Community describes a cost-cutting approach to web scraping infrastructure called a 'proxy waterfall,' which routes requests through progressively expensive tiers only when cheaper options fail. The method starts with direct requests and free TLS fingerprint fixes before escalating to datacenter proxies, then residential proxies, and finally managed anti-bot services as a last resort. The author reports reducing spending on BrightData by 90% and ScrapingBee by 67% for a client without any drop in success rates, simply by restructuring how traffic is routed. A key technical insight is that soft blocks — pages returning HTTP 200 but containing a CAPTCHA or decoy content — must be detected through content-level validation rather than HTTP status codes alone. The approach also caches which proxy tier succeeded for each URL pattern, avoiding unnecessary escalation on repeat requests.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Recover Missed LINE MINI App Purchase Webhooks Using a 7-Day History API

LINE MINI App purchases follow a multi-step flow where a successful reservation does not confirm payment — only a purchaseComplete webhook serves as the definitive proof of a completed transaction. When webhooks are missed due to server downtime, deployment issues, or processing failures, LINE's event history API allows developers to retrieve purchase events from the past seven days. The API supports pagination via a cursor and can be filtered by delivery status, though omitting the status filter is recommended when failures occurred after the endpoint accepted the request. Developers must store key reservation data — including the orderId, x-line-request-id header, and entitlement state — to enable accurate reconciliation. Idempotency checks keyed by orderId are essential to ensure that digital items or entitlements are granted exactly once during recovery.

0 comments Read more at DEV Community