Cloudanix VulnDB

CVE-2022-3032

Medium · 6.5

CVSS

6.5

EPSS

0.7%

Published

Dec 22, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An older version of the Thunderbird email program could let pictures or videos from certain messages load anyway, even when they were supposed to stay blocked, which might let the sender know the message was opened.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits remote objects referenced inside an iframe element's srcdoc attribute within an HTML email to bypass content blocking, allowing network access and rendering of images, videos, or other resources that should have been suppressed.

Why it matters to the business

Email users on unpatched Thunderbird installations face potential privacy loss through remote content loading that can enable tracking or information disclosure; given the vulnerability's age and low exploitation probability, residual risk remains limited to legacy or unmaintained deployments.

How an attack unfolds

An attacker crafts an HTML email containing an iframe with a srcdoc attribute that references external resources; when the recipient views the message, the client loads the nested document and fetches the remote objects over the network, revealing that the message was opened.

How to fix it

Upgrade Mozilla Thunderbird to version 102.2.1 or 91.13.1 (or later releases) to enforce blocking of remote objects in srcdoc iframes; verify the update through the application's built-in updater or package manager.

How to confirm the fix worked

Confirm the installed Thunderbird version meets or exceeds 102.2.1 or 91.13.1; test rendering of a sample HTML email containing an iframe with srcdoc and remote image references to ensure network requests are blocked.

Typical attack path

  1. Attacker composes and sends a specially crafted HTML email containing an iframe with srcdoc referencing remote resources
  2. Recipient opens the email in an affected Thunderbird version
  3. Client renders the nested document and initiates network requests for the remote objects
  4. Remote server logs the requests or serves tracking content, confirming message access

How to detect it

Inspect email client logs and network traffic for unexpected outbound requests to domains referenced inside email-rendered iframes; correlate message receipt timestamps with external resource fetches originating from the mail client process.

What your security team should do

  • Prioritize updating all Thunderbird installations to the fixed versions listed in the advisory
  • Review and enforce email content blocking policies within the client
  • Monitor for any remaining legacy deployments that cannot be immediately updated

The record

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 thunderbird 0 102.3.0-3.el8_6.alma
AlmaLinux:9 thunderbird 0 102.3.0-3.el9_0.alma
Debian:12 thunderbird 0 1:102.2.1-1
Debian:13 thunderbird 0 1:102.2.1-1
Red Hat:enterprise_linux:7::client thunderbird 0 0:102.3.0-3.el7_9
Red Hat:enterprise_linux:7::client thunderbird-debuginfo 0 0:102.3.0-3.el7_9
Red Hat:enterprise_linux:7::server thunderbird 0 0:102.3.0-3.el7_9
Red Hat:enterprise_linux:7::server thunderbird-debuginfo 0 0:102.3.0-3.el7_9
Red Hat:enterprise_linux:7::workstation thunderbird 0 0:102.3.0-3.el7_9
Red Hat:enterprise_linux:7::workstation thunderbird-debuginfo 0 0:102.3.0-3.el7_9
Red Hat:enterprise_linux:8::appstream thunderbird 0 0:102.3.0-3.el8_6
Red Hat:enterprise_linux:8::appstream thunderbird-debuginfo 0 0:102.3.0-3.el8_6
Red Hat:enterprise_linux:8::appstream thunderbird-debugsource 0 0:102.3.0-3.el8_6
Red Hat:enterprise_linux:9::appstream thunderbird 0 0:102.3.0-3.el9_0
Red Hat:enterprise_linux:9::appstream thunderbird-debuginfo 0 0:102.3.0-3.el9_0
Red Hat:enterprise_linux:9::appstream thunderbird-debugsource 0 0:102.3.0-3.el9_0
Red Hat:rhel_e4s:8.1::appstream thunderbird 0 0:102.3.0-3.el8_1
Red Hat:rhel_e4s:8.1::appstream thunderbird-debuginfo 0 0:102.3.0-3.el8_1
Red Hat:rhel_e4s:8.1::appstream thunderbird-debugsource 0 0:102.3.0-3.el8_1
Red Hat:rhel_eus:8.2::appstream thunderbird 0 0:102.3.0-3.el8_2
Red Hat:rhel_eus:8.2::appstream thunderbird-debuginfo 0 0:102.3.0-3.el8_2
Red Hat:rhel_eus:8.2::appstream thunderbird-debugsource 0 0:102.3.0-3.el8_2
Red Hat:rhel_eus:8.4::appstream thunderbird 0 0:102.3.0-3.el8_4
Red Hat:rhel_eus:8.4::appstream thunderbird-debuginfo 0 0:102.3.0-3.el8_4
Red Hat:rhel_eus:8.4::appstream thunderbird-debugsource 0 0:102.3.0-3.el8_4
Rocky Linux:8 thunderbird 0 0:102.3.0-3.el8_6
SUSE:Linux Enterprise Module for Package Hub 15 SP3 MozillaThunderbird 0 102.2.2-150200.8.82.1
SUSE:Linux Enterprise Module for Package Hub 15 SP4 MozillaThunderbird 0 102.2.2-150200.8.82.1
SUSE:Linux Enterprise Workstation Extension 15 SP3 MozillaThunderbird 0 102.2.2-150200.8.82.1
SUSE:Linux Enterprise Workstation Extension 15 SP4 MozillaThunderbird 0 102.2.2-150200.8.82.1
Ubuntu:18.04:LTS thunderbird 0 1:102.2.2+build1-0ubuntu0.18.04.1
Ubuntu:20.04:LTS thunderbird 0 1:102.2.2+build1-0ubuntu0.20.04.1
Ubuntu:22.04:LTS thunderbird 0 1:102.2.2+build1-0ubuntu0.22.04.1
openSUSE:Leap 15.3 MozillaThunderbird 0 102.2.2-150200.8.82.1
openSUSE:Leap 15.4 MozillaThunderbird 0 102.2.2-150200.8.82.1
openSUSE:Tumbleweed MozillaThunderbird 0 102.2.1-1.1

Related vulnerabilities