Description

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T22:17:20.000Z",
  "pubdate": "2026-09-01T22:17:20.000Z",
  "executiveSummary": "This vulnerability is an improper input validation flaw categorized as a regular expression injection within the Thunderbird email client. The issue stems from the insecure handling of the 'mail.allowed_attachment_hostnames' advanced configuration setting, where user-supplied hostnames are dynamically incorporated into a regular expression without appropriate sanitization or escaping.\nThe primary risk involves the potential for attackers to bypass intended hostname restrictions, facilitating the unauthorized retrieval of remote attachments from malicious or unintended domains. An attacker with the capability to influence the configuration settings or exploit a vector relying on these attachment hostnames could potentially widen the scope of trusted sources beyond the intended security policy.\nThe vulnerability affects Thunderbird versions prior to 153.2 and 155. Successful exploitation allows for the serving of remote content from unauthorized locations, potentially facilitating phishing, data exfiltration, or the delivery of malicious payloads. Mitigation requires immediate updating to the patched versions to ensure that hostname validation logic is correctly implemented and sanitized against regex meta-character injection.",
  "technicalDetails": "The root cause of this vulnerability is the failure to escape meta-characters within the 'mail.allowed_attachment_hostnames' configuration parameter before its inclusion into a regular expression pattern. In the context of regex evaluation, characters such as the dot (.), asterisk (*), or plus sign (+) serve as control symbols rather than literal characters.\nWhen a user or a configuration policy provides a hostname intended to be matched literally, the application fails to treat the input as a string literal. Instead, it processes the input as part of a regex pattern. For instance, a dot intended to represent a period in a domain name is interpreted as a wildcard matching any character. Consequently, an attacker or a specifically crafted input can induce the regex engine to accept unintended hostnames that share a partial pattern match with the authorized list.\nThe attack flow involves the following steps: 1) The application retrieves the list of allowed hostnames from the 'mail.allowed_attachment_hostnames' configuration. 2) The system constructs a regular expression by concatenating these hostnames without sanitization. 3) When an email attempts to load a remote attachment, the system validates the source hostname against this malformed regex. 4) An attacker exploits the lack of escaping by providing a malicious hostname string designed to trigger a 'false positive' match. 5) The regex engine evaluates the malicious hostname as a match due to the unescaped regex meta-characters. 6) The Thunderbird client proceeds to fetch the remote content from the unauthorized server, believing it to be a trusted source.\nThis behavior results in a bypass of the security boundary originally intended to restrict remote resource fetching. The vulnerability exists within the Thunderbird codebase responsible for parsing and enforcing the attachment policy. By circumventing these checks, an attacker can effectively force the client to communicate with arbitrary external servers. The impact is significant, as it can be leveraged to track users via remote content loading, deliver malicious files, or bypass organizational security policies regarding allowed remote attachment sources. This vulnerability was effectively addressed in Thunderbird 153.2 and 155 by introducing proper character escaping mechanisms within the regex construction logic, ensuring that configuration strings are treated as literals during pattern matching."
}