CVE-2024-11159: Thunderbird Information Disclosure Flaw

CVE-2024-11159 Overview

CVE-2024-11159 is an information disclosure vulnerability in Mozilla Thunderbird that affects how the mail client handles remote content within OpenPGP encrypted messages. When a user views a crafted encrypted email, embedded references to remote content can trigger network requests that leak fragments of the decrypted plaintext to an attacker-controlled server. The flaw is tracked under [CWE-312: Cleartext Storage of Sensitive Information] and impacts Thunderbird versions prior to 128.4.3 and 132.0.1. Exploitation requires user interaction to open the message, and the attack vector is network-based. Mozilla addressed the issue in advisories MFSA-2024-61 and MFSA-2024-62.

Critical Impact

A remote attacker can exfiltrate plaintext from OpenPGP encrypted messages by embedding remote content references that are fetched when the recipient opens the email.

Affected Products

• Mozilla Thunderbird versions prior to 128.4.3
• Mozilla Thunderbird versions prior to 132.0.1
• Debian LTS distributions packaging affected Thunderbird builds

Discovery Timeline

• 2024-11-13 - CVE-2024-11159 published to NVD
• 2024-11-13 - Mozilla publishes security advisories MFSA-2024-61 and MFSA-2024-62
• 2024-12-06 - Last updated in NVD database

Technical Details for CVE-2024-11159

Vulnerability Analysis

The vulnerability resides in Thunderbird's handling of remote content references embedded inside OpenPGP encrypted messages. When Thunderbird decrypts a message, the rendered HTML body can contain references such as image tags or stylesheet links pointing to attacker-controlled hosts. If these remote resources are loaded, portions of the decrypted plaintext can be included in the outbound request, effectively converting the mail client into an oracle for plaintext disclosure. The issue is classified under [CWE-312] because sensitive decrypted content is transmitted in cleartext over the network. Successful exploitation requires the recipient to open the crafted message, and the impact is limited to confidentiality of the decrypted content.

Root Cause

The root cause is insufficient isolation between decrypted OpenPGP content and the remote content loading subsystem. Thunderbird's existing protections against loading remote resources did not consistently apply to all elements rendered from within an OpenPGP encrypted MIME part. Attacker-controlled markup placed inside the encrypted payload could therefore initiate network requests that included context from the surrounding plaintext.

Attack Vector

An attacker crafts an OpenPGP encrypted email containing HTML elements that reference remote resources hosted on infrastructure they control. The attacker sends the message to a target Thunderbird user. When the recipient opens the message and Thunderbird decrypts and renders it, the client issues HTTP requests for the referenced remote content. URL parameters or path components reflect portions of the decrypted plaintext, which the attacker collects from web server logs. Refer to the Mozilla bug report for technical details.

Detection Methods for CVE-2024-11159

Indicators of Compromise

• Outbound HTTP or HTTPS requests originating from Thunderbird processes (thunderbird.exe, thunderbird-bin) to previously unseen external domains immediately after a user opens an encrypted message.
• Email messages with multipart/encrypted MIME structure containing HTML body parts that reference external img, link, or iframe resources.
• Web proxy logs showing unusual query strings or path components that resemble fragments of email content.

Detection Strategies

• Correlate Thunderbird process telemetry with network connection events to flag remote content fetches that occur during the rendering of OpenPGP messages.
• Inspect inbound mail at the gateway for encrypted messages whose decrypted structure (where policy permits) contains remote resource references.
• Hunt for Thunderbird installations running versions earlier than 128.4.3 or 132.0.1 across the endpoint inventory.

Monitoring Recommendations

• Enable DNS and HTTP egress logging from workstations running Thunderbird and retain the data for retrospective hunting.
• Alert on Thunderbird connections to low-reputation domains, newly registered domains, or domains not on an allowlist of known mail-related services.
• Track Thunderbird version distribution across the fleet using endpoint inventory data to confirm patch coverage.

How to Mitigate CVE-2024-11159

Immediate Actions Required

• Upgrade Thunderbird to version 128.4.3, 132.0.1, or later on all endpoints.
• Disable automatic loading of remote content in Thunderbird preferences until patching is complete.
• Review recent encrypted mail traffic and endpoint network telemetry for signs of opportunistic exploitation against unpatched clients.

Patch Information

Mozilla released fixes in Thunderbird 128.4.3 and 132.0.1. Patch details are documented in Mozilla Security Advisory MFSA-2024-61 and Mozilla Security Advisory MFSA-2024-62. Debian users should apply updates referenced in the Debian LTS announcement.

Workarounds

• In Thunderbird, navigate to Preferences > Privacy & Security and disable Allow remote content in messages for all accounts.
• Use enterprise policy files (policies.json) to enforce blocking of remote content across managed Thunderbird deployments.
• Instruct users not to open OpenPGP encrypted messages from untrusted senders until patches are deployed.

# Configuration example: enforce blocking of remote content via Thunderbird enterprise policy
# Place this file at the appropriate policies path for your platform
cat > /etc/thunderbird/policies/policies.json <<'EOF'
{
  "policies": {
    "DisableMasterPasswordCreation": false,
    "OfferToSaveLogins": false,
    "Preferences": {
      "mailnews.message_display.disable_remote_image": {
        "Value": true,
        "Status": "locked"
      },
      "permissions.default.image": {
        "Value": 2,
        "Status": "locked"
      }
    }
  }
}
EOF