Protocol Handler Exposure in Thunderbird: CVE-2024-9398
Summary
DEBIAN-CVE-2024-9398: By checking the result of calls to window.open with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. Affects thunderbird versions < 1:128.3.0esr-1. Fixed in 1:128.3.0esr-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Thunderbird is a widely used open-source email client developed by Mozilla. It allows users to manage their emails, calendars, and contacts efficiently. The application supports various protocols for handling emails and integrates with different services. However, it is susceptible to vulnerabilities that can expose user data or system configurations, such as CVE-2024-9398, which allows attackers to determine if specific protocol handlers are installed on the user's system.
Vulnerability Detail
CVE-2024-9398 arises from the way Thunderbird handles calls to the 'window.open' function with specific protocol handlers. An attacker can exploit this by crafting a malicious link that, when clicked, checks for the presence of applications associated with those protocol handlers. This could lead to information disclosure about the user's system, potentially allowing further attacks or exploitation. The vulnerability affects versions of Thunderbird prior to 128.3.0esr and 131, making it critical for users to update their software to mitigate risks.
How To Fix
Minimum fixed version
1:128.3.0esr-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade thunderbirdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid clicking on untrusted links that may exploit this vulnerability until they can update their Thunderbird installation. Additionally, consider disabling any unnecessary protocol handlers in the application settings.
Conclusion
CVE-2024-9398 is a significant vulnerability affecting Thunderbird that can lead to information disclosure regarding installed protocol handlers. Users are strongly advised to update their software to the latest version to mitigate this risk. Additionally, employing Vulert can help in real-time monitoring of vulnerabilities in your applications.
See every vulnerability recorded for thunderbird →
FAQ
CVE-2024-9398 is a vulnerability in Thunderbird that allows attackers to determine if certain protocol handlers are installed on a user's system through the 'window.open' function.
You can check your version of Thunderbird by going to Help > About Thunderbird in the application. If your version is below 128.3.0esr or 131, it is affected.
If you cannot update immediately, avoid clicking on suspicious links and consider disabling unnecessary protocol handlers as a temporary measure.
More information can be found in the official Debian CVE database or by visiting the vulnerability details at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-9398.json.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by vulnerabilities using the Vulert playground at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for thunderbird.
