CVE-2021-47768: ImportExportTools NG XSS Vulnerability

CVE-2021-47768 Overview

CVE-2021-47768 is a persistent HTML injection vulnerability affecting ImportExportTools NG version 10.0.4, a popular add-on for Mozilla Thunderbird used for importing and exporting email messages. The vulnerability exists in the email export module and allows remote attackers to inject malicious HTML payloads through specially crafted email subjects. When a user exports emails to HTML format, the injected code executes in the context of the exported document, potentially compromising user data or session credentials.

Critical Impact

Remote attackers can inject persistent HTML content through email subjects that execute during HTML export operations, enabling potential data theft or credential compromise.

Affected Products

• ImportExportTools NG 10.0.4
• Mozilla Thunderbird installations with the vulnerable add-on

Discovery Timeline

• 2026-01-15 - CVE CVE-2021-47768 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2021-47768

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw stems from insufficient input sanitization in the email export functionality of ImportExportTools NG. When processing email messages for export to HTML format, the add-on fails to properly encode or sanitize the subject field, allowing HTML and script content embedded in email subjects to persist in the exported files.

The attack requires minimal complexity—an attacker simply needs to send an email with a malicious HTML payload embedded in the subject line to a target user. When the victim exports their emails using the ImportExportTools NG add-on's HTML export feature, the malicious code is rendered and executed. This creates a stored/persistent HTML injection scenario where the payload remains active in the exported document.

The network-based attack vector means exploitation can occur remotely through standard email delivery mechanisms. While user interaction is required (the victim must perform an HTML export operation), this is a common action for users of this add-on, making exploitation realistic in practice.

Root Cause

The root cause of this vulnerability is the failure to implement proper output encoding when generating HTML export files. The ImportExportTools NG add-on directly incorporates email subject content into the HTML output without escaping special characters such as <, >, ", and &. This allows attackers to break out of the expected HTML context and inject arbitrary HTML elements or JavaScript code.

Attack Vector

The attack is executed via network (email delivery) and follows this sequence:

1. Attacker crafts an email with malicious HTML/JavaScript embedded in the subject field
2. Email is delivered to the target through standard SMTP channels
3. Target user receives the email in Thunderbird with ImportExportTools NG installed
4. When the user exports emails to HTML format using the add-on, the malicious payload is written directly into the exported HTML file
5. When the exported HTML file is opened in a browser, the injected code executes

The injected HTML could be used to steal sensitive information displayed in the exported emails, redirect users to phishing sites, or perform other malicious actions within the context of the local HTML file.

Detection Methods for CVE-2021-47768

Indicators of Compromise

• Presence of HTML tags or JavaScript code in email subject lines (e.g., <script>, <img onerror=, <iframe>)
• Exported HTML files containing unexpected script tags or event handlers
• Unusual network requests originating from opened HTML export files

Detection Strategies

• Monitor email logs for messages containing HTML syntax in subject fields
• Implement email gateway rules to flag or quarantine messages with suspicious subject content containing HTML tags
• Scan exported HTML files for unexpected embedded scripts or external resource references

Monitoring Recommendations

• Enable logging for the ImportExportTools NG add-on export operations where possible
• Configure endpoint detection to alert on HTML files executing JavaScript from user-accessible directories
• Review Thunderbird profile directories for anomalous exported content

How to Mitigate CVE-2021-47768

Immediate Actions Required

• Update ImportExportTools NG to the latest available version from the official Thunderbird Add-ons repository
• Review and disable the HTML export feature if not actively needed
• Avoid exporting emails from untrusted or suspicious senders to HTML format
• Open exported HTML files only in sandboxed or isolated environments

Patch Information

Users should check the GitHub repository for ImportExportTools NG for updated releases that address this vulnerability. The add-on can be updated directly through Thunderbird's Add-ons Manager by navigating to Menu > Add-ons and Themes > Extensions and checking for available updates.

Additional technical details about this vulnerability are available through Exploit-DB #50496 and Vulnerability Lab #2308.

Workarounds

• Use alternative export formats (such as plain text or EML) instead of HTML export until a patch is applied
• Pre-filter suspicious emails before export by reviewing subject lines for HTML characters
• Configure email clients to render emails in plain text mode to help identify suspicious subject content
• Implement Content Security Policy (CSP) headers if serving exported HTML files through a web server