Magnus Melin

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.

Thunderbird automatically loads the content of OpenPGP key attachments to facilitate key importing. A sender can mark such an attachment as an external attachment pointing to an arbitrary URL, causing the application to load the URL without user interaction and bypassing remote content blocking. On Windows, if the URL points to an attacker-controlled network share, the user's NTLM credentials (a suite of security protocols used for authentication) can be leaked. On other operating systems, this allows an unauthorized remote request.

Thunderbird accepts calendar locations pointing to external servers, local files, or network shares during account setup or when adding a new network calendar. A malicious server or a network attacker using plain HTTP can force the application to subscribe to these locations. On Windows, this can lead to the leakage of NTLM credentials to an attacker-controlled host during calendar refreshes. Additionally, calendar changes may be written to an attacker's share or used to overwrite local files.

Thunderbird fails to validate the homeserver address received in the login response during Matrix account authentication. A compromised or malicious homeserver can provide a `file:` URL, redirecting subsequent session requests to local files. On Windows systems, this can be used to redirect requests to an attacker-controlled network share, leading to the leak of the user's NTLM (New Technology LAN Manager) credentials, which is a suite of security protocols used for authentication.

During account setup, the Exchange AutoDiscover lookup sends an unencrypted request over plain HTTP to the domain's AutoDiscover service. A bug causes this request to include the user's entered credentials, which allows a network attacker to intercept and obtain the user's password.

Thunderbird fails to escape attribute values when serializing outgoing XMPP stanzas. Since values from incoming requests are echoed back in automatic replies, a remote XMPP user can send a crafted request to inject arbitrary stanzas into the user's connection. The server then processes these stanzas as if they were sent by the user, allowing the attacker to send messages or modify contact and subscription settings without user interaction. This issue specifically affects the chat feature used with XMPP accounts.

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.4.3 Thunderbird versions prior to 132.0.1 Description: The issue is related to the use of remote content in OpenPGP encrypted messages, which can lead to the disclosure of plaintext. This is due to insufficient protection of service data in the implementation of the OpenPGP email encryption standard in the Mozilla Thunderbird email client. An attacker can exploit this vulnerability to reveal protected information. Recommendations: For Thunderbird versions prior to 128.4.3, update to version 128.4.3 or later. For Thunderbird versions prior to 132.0.1, update to version 132.0.1 or later. As a temporary workaround, consider avoiding the use of remote content in OpenPGP encrypted messages until a patch is available.

The issue arises when an attacker intercepts Thunderbird's initial attempt to set up an account automatically using the Microsoft Exchange autodiscovery mechanism. If the attacker sends a crafted response, Thunderbird will send the `username` and `password` over https to a server controlled by the attacker.