On 8/9/23 07:38, dovecot--- via dovecot wrote:
Roundcube does not have direct file access to the emails even on the same server. Roundcube opens a connection to dovecot, supplies the user/pass/login credentials to dovecot, and dovecot fetches the email stores and serves it to roundcube. There is nothing a hacker can gain access to by exploiting roundcube that they also couldn't get in the same scenario if roundcube and dovecot were on two different machines.
The scenario you describe does not consider a breach of the web mail service that allows root access to the file system.
If the web service is compromised to that extent then the mail file store is also compromised.
If the mail file store is on a different device then an exploit has to not only breach the web service on the interface device, it then has to breach the remote store. This will be extremely difficult compared to simply breaching a web server and locally exploiting it.
When the dovecot server is on a remote system and correct firewalls are in place, then the attacker has to breach the imap protocols as well
This article describes the concept
https://www.fortinet.com/resources/cyberglossary/what-is-dmz