Mozilla Thunderbird External Attachment URL Processing Vulnerability Leading to Windows Credential Leakage

A vulnerability exists in Mozilla Thunderbird versions prior to 137.0.2 and Thunderbird ESR versions prior to 128.9.2, where the application improperly processes the X-Mozilla-External-Attachment-URL header. This flaw allows external URLs to reference internal resources, such as chrome:// links or SMB file:// shares. When an email is opened, Thunderbird accesses these URLs to check file sizes and navigates to them upon user interaction. The lack of validation or sanitization can result in the leakage of hashed Windows credentials, potentially leading to more severe security issues.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of hashed Windows credentials, with the possibility of further security complications.

Remediation

Users can upgrade to Thunderbird version 137.0.2 or Thunderbird ESR version 128.9.2 to address this vulnerability.