CVE-2022-45414 Server-side request forgery in Thunderbird
Attackers can force Thunderbird to make remote network requests via HTML tags, bypassing remote content blocking and potentially leaking user information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-45414?
CVE-2022-45414 is a high-severity server-side request forgery vulnerability in Mozilla Thunderbird, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
Weakness: CWE-200
Which versions are affected by CVE-2022-45414?
It affects 1 product.
Linux distribution packages (7)
MozillaThunderbird SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 102.5.1-150200.8.93.1 |
MozillaThunderbird SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 102.5.1-150200.8.93.1 |
MozillaThunderbird SUSE:Linux Enterprise Workstation Extension 15 SP3 | All versions | 102.5.1-150200.8.93.1 |
MozillaThunderbird SUSE:Linux Enterprise Workstation Extension 15 SP4 | All versions | 102.5.1-150200.8.93.1 |
MozillaThunderbird openSUSE:Leap 15.3 | All versions | 102.5.1-150200.8.93.1 |
MozillaThunderbird openSUSE:Leap 15.4 | All versions | 102.5.1-150200.8.93.1 |
MozillaThunderbird openSUSE:Tumbleweed | All versions | 102.5.1-1.1 |
Products include Mozilla Thunderbird.
How do I fix CVE-2022-45414?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-45414 being exploited?
There is no known exploitation of CVE-2022-45414 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2022-45414, GHSA-gvhr-fq94-q7h9, MGASA-2022-0452, SUSE-SU-2022:4334-1, UBUNTU-CVE-2022-45414, openSUSE-SU-2024:12544-1.