CVE-2025-1015: Mozilla Thunderbird XSS Vulnerability

CVE-2025-1015 Overview

The Thunderbird Address Book URI fields contained unsanitized links that could be exploited by an attacker to create and export an address book containing a malicious payload. This Cross-Site Scripting (XSS) vulnerability specifically affects URI fields in the Address Book component, such as the "Other" field in the Instant Messaging section. If a victim imports a maliciously crafted address book and clicks on the embedded link, a web page could be opened inside Thunderbird that executes unprivileged JavaScript code.

Critical Impact

Attackers can craft malicious address book exports containing XSS payloads that execute JavaScript within the Thunderbird client when imported and clicked by victims, potentially leading to information disclosure or session manipulation.

Affected Products

• Mozilla Thunderbird versions prior to 128.7 (ESR)
• Mozilla Thunderbird versions prior to 135

Discovery Timeline

• 2025-02-04 - CVE-2025-1015 published to NVD
• 2025-03-10 - Last updated in NVD database

Technical Details for CVE-2025-1015

Vulnerability Analysis

This vulnerability is classified as Cross-Site Scripting (CWE-79), where insufficient input sanitization in Thunderbird's Address Book component allows malicious URIs to be embedded in contact fields. The attack requires user interaction—specifically, the victim must import a crafted address book file and then click on a malicious link within a contact entry.

The exploitation chain involves an attacker creating an address book with specially crafted URI values in fields designed to store instant messaging or other contact information. When exported and shared with a victim, the unsanitized links can trigger JavaScript execution within the Thunderbird application context. While the JavaScript runs unprivileged, it could still be leveraged for phishing attacks, information gathering, or further social engineering campaigns.

Root Cause

The root cause of this vulnerability is missing input sanitization on URI fields within the Thunderbird Address Book component. When processing contact entries, Thunderbird failed to properly validate and sanitize URL schemes and content in fields like the "Other" instant messaging field. This allowed attackers to inject arbitrary JavaScript-containing URIs that bypass the expected URL handling behavior.

Attack Vector

The attack leverages network-based distribution combined with social engineering. An attacker would:

1. Create a new contact entry in Thunderbird's Address Book
2. Insert a malicious payload into a URI field (e.g., the "Other" field in the Instant Messaging section)
3. Export the address book to a shareable format
4. Distribute the malicious address book file to potential victims via email or file sharing
5. When the victim imports the address book and clicks the malicious link, JavaScript executes within Thunderbird's rendering context

The attack requires no special privileges from the attacker but does require user interaction from the victim to both import the address book and click the malicious link. For technical details regarding the specific vulnerability, see the Mozilla Bug Report #1939458.

Detection Methods for CVE-2025-1015

Indicators of Compromise

• Suspicious .mab or exported address book files received from untrusted sources
• Address book entries containing unusual URI schemes or JavaScript code in contact fields
• Unexpected network connections originating from Thunderbird after importing address books
• Browser history or logs showing web pages loaded within the Thunderbird context

Detection Strategies

• Monitor for import operations of address book files from external or untrusted sources
• Implement email attachment scanning to detect potentially malicious address book exports
• Review Thunderbird logs for unusual URI handling or JavaScript execution events
• Deploy endpoint detection solutions to identify anomalous behavior from email client processes

Monitoring Recommendations

• Enable logging on email gateways to track address book file attachments (.mab, .ldif, .csv)
• Configure SentinelOne Singularity to monitor Thunderbird process behavior for suspicious child processes or network activity
• Establish baseline behavior for Thunderbird and alert on deviations such as unexpected script execution
• Implement user training to recognize and report suspicious address book files

How to Mitigate CVE-2025-1015

Immediate Actions Required

• Update Mozilla Thunderbird to version 128.7 (ESR) or 135 or later immediately
• Advise users to avoid importing address books from untrusted or unknown sources
• Review recently imported address books for suspicious entries containing unusual URIs
• Consider temporarily disabling address book import functionality in enterprise environments until patches are applied

Patch Information

Mozilla has addressed this vulnerability in Thunderbird versions 128.7 (ESR) and 135. Organizations should prioritize updating all Thunderbird installations to these patched versions. Detailed patch information is available in the Mozilla Security Advisory MFSA-2025-10 and Mozilla Security Advisory MFSA-2025-11.

Workarounds

• Implement email filtering rules to quarantine or block address book file attachments
• Instruct users to only import address books from trusted internal sources
• Use application control policies to restrict Thunderbird's ability to execute scripts or open web content
• Consider deploying a web proxy to inspect and filter traffic originating from Thunderbird

# Example: Block address book imports via Thunderbird policy (thunderbird.cfg)
// Disable address book import as a temporary workaround
lockPref("mail.addr_book.import.disabled", true);