The application might actually be vulnerable.īy default, HTML tags like and are blocked in Thunderbird and get filtered immediately upon insertion however, Most of the information revealed is Javascript errors which gave the researcher much hope in believing that exe file revealed some very interesting information and gave much better insight behind the actual It was initially noticed that malicious javascript tags were being filtered / blocked in the Thunderbird application however, AttachingĪ debugger with the Thunderbird. It has been discovered that the security controls / filters currently being used in Mozilla Thunderbird application can be easilyĮvaded if an attacker decides to encrypt the payloads with base64 encryption and combine it with the tag. Product: Thunderbird - EMail Application 17.0.6 : Public Disclosure (Vulnerability Laboratory) : Vendor Fix/Patch (Mozilla Developer Team - Reward 1.500$ SWB)
: Vendor Response/Feedback (Mozilla Security Incident Team) : Vendor Notification (Mozilla Security Incident Team) : Researcher Notification & Coordination (Ateeq ur Rehman Khan) The Vulnerability Laboratory Research Team discovered a critical validation and filter bypass vulnerability in the official Mozilla Thunderbird 17.0.6 email software. Thunderbird is part of the Mozilla Manifesto, a pledge thatĭescribes Mozilla`s commitment to an open, accessible, egalitarian Internet. There are lots of add-ons available for Thunderbird thatĮnable you to extend and customize your email experience.
Thunderbird gives you control and ownership over your email. Local (rather than a web-based) email application that is powerful yet easy-to-use. Thunderbird is a free, open-source, cross-platform application for managing email and news feeds. Mozilla Bug Bounty #5 - WireTap Remote Web Vulnerability
0 kommentar(er)
