Exploit-DB #31223
Description: Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass
Type: dos
Platform: multiple
Date: 2014-01-27
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Mozilla Bug Bounty #5 - WireTap Remote Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=953

Mozilla Bug Tracking ID: 875818

Video: http://www.vulnerability-lab.com/get_content.php?id=1182

Partner News (Softpedia): http://news.softpedia.com/news/Critical-Validation-and-Filter-Bypass-Vulnerability-Fixed-in-Thunderbird-420962.shtml


Release Date:
=============
2014-01-27


Vulnerability Laboratory ID (VL-ID):
====================================
953


Common Vulnerability Scoring System:
====================================
7.3


Product & Service Introduction:
===============================
Thunderbird is a free, open-source, cross-platform application for managing email and news feeds. It is a 
local (rather than a web-based) email application that is powerful yet easy-to-use. Thunderbird has lots of cool features. 
Thunderbird gives you control and ownership over your email. There are lots of add-ons available for Thunderbird that 
enable you to extend and customize your email experience. Thunderbird is part of the Mozilla Manifesto, a pledge that 
describes Mozilla`s commitment to an open, accessible, egalitarian Internet.

( Copy of the Vendor Homepage: http://www.mozilla.org )
( Copy of the Product Homepage: http://www.mozilla.org/en-US/thunderbird/ )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a critical validation and filter bypass vulnerability in the official Mozilla Thunderbird 17.0.6 email software.


Vulnerability Disclosure Timeline:
==================================
2013-05-10: Researcher Notification & Coordination (Ateeq ur Rehman Khan)
2013-05-11: Vendor Notification (Mozilla Security Incident Team)
2013-05-21: Vendor Response/Feedback (Mozilla Security Incident Team)
2014-01-18: Vendor Fix/Patch (Mozilla Developer Team - Reward 1.500$ SWB)
2014-01-27: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Mozilla
Product: Thunderbird - EMail Application 17.0.6


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
It has been discovered that the security controls / filters currently being used in Mozilla Thunderbird application can be easily 
evaded if an attacker decides to encrypt the payloads with base64 encryption and combine it with the <object> tag. During the testing,
it was initially noticed that malicious javascript tags were being filtered / blocked in the Thunderbird application however, Attaching 
a debugger with the Thunderbird .exe file revealed some very interesting information and gave much better insight behind the actual 
working of the application. Most of the information revealed is Javascript errors which gave the researcher much hope in believing that
the application might actually be vulnerable.

By default, HTML tags like <script> and <iframe> are blocked in Thunderbird and get filtered immediately upon insertion however, 
While drafting a new email message, attackers can easily bypass the current input filters by encoding their payloads
with base64 encryption and using the <object> tag and insert malicious scripts / code eg. (script / frame) within the emails 
and send it to the victims. The exploit gets triggered once the victim decides to reply back and clicks on the `Reply` or `Forward` Buttons.

After successfully bypassing the input filters, an attacker can inject persistent script code while writing a new email and send it to victims.
Interestingly the payload gets filtered during the initial viewing mode however if the victim clicks on Reply or Forward, the exploit gets executed
successfully. For a POC i will be including multiple examples in this advisory for your review. I was able to run multiple scripts generating strange
behaviour on the application which can be seen in the debugging errors which I have attached along with this report.

These sort of vulnerabilities can result in multiple attack vectors on the client end which may eventually result in complete
compromise of the end user system. The persistent code injection vulnerability is located within the main application.

Exploitation of this persistent application vulnerability requires a low or medium user interaction. Successful exploitation of
the vulnerability may result in malicious script code being executed in the victims browser resulting in script code injection, 
persistent phishing, Client side redirects and similar client side attacks.

Vulnerable Service(s):
			[+] Mozilla Thunderbird 17.0.6 - Latest Release 

Vulnerable Section(s):
			[+] Write (Create a new message)
			[+] Email Signature (Account Settings)
			[+] Attach File with Signature as HTML (Account Settings)


Proof of Concept (PoC):
=======================
The filter bypass & persistent script code inject web vulnerabilities can be exploited by remote attackers without privileged user account 
or direct user interaction. For security demonstration or to reproduce the vulnerability follow the provided steps and information below.

Proof of Concept #1

a) Create a new email message
b) In the body text, insert new HTML tag with the POC "Payload"
c) Send the email to the victim
d) Open the new email in the victim browser and click Reply
e) You should now see a Javascript Application popup window proving the existence of this vulnerability.


Proof of Concept #2

a) Goto Tools and then Account Settings
b) Under the Signature Text, insert the Payload and enable 'Use HTML'
c) Close the menu and Click on "Write" to create a new email
d) You should get a popup the moment new Email editor window opens up proving the existen