CVE-2021-47768
📋 TL;DR
CVE-2021-47768 is a persistent HTML injection vulnerability in ImportExportTools NG 10.0.4 for Thunderbird. Attackers can send emails with malicious HTML in subjects that execute during HTML export, potentially compromising user data or session credentials. Users of the vulnerable add-on version are affected.
💻 Affected Systems
- ImportExportTools NG Thunderbird add-on
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session credentials or sensitive user data through malicious HTML execution during email export, leading to account compromise or data exfiltration.
Likely Case
Attackers inject malicious scripts that execute when users export emails to HTML, potentially stealing browser session data or performing unauthorized actions.
If Mitigated
With proper input validation and output encoding, HTML injection is prevented, maintaining email export functionality safely.
🎯 Exploit Status
Exploitation requires sending crafted emails to target users who then export them using the vulnerable add-on.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.5 or later
Vendor Advisory: https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/
Restart Required: Yes
Instructions:
1. Open Thunderbird. 2. Go to Add-ons Manager. 3. Check for updates for ImportExportTools NG. 4. Update to version 10.0.5 or later. 5. Restart Thunderbird.
🔧 Temporary Workarounds
Disable HTML Export
allTemporarily disable HTML export functionality in ImportExportTools NG settings.
Uninstall Add-on
allRemove ImportExportTools NG until patched version is available.
🧯 If You Can't Patch
- Avoid exporting emails to HTML format using the vulnerable add-on.
- Use alternative email export methods or tools until patched.
🔍 How to Verify
Check if Vulnerable:
Check ImportExportTools NG version in Thunderbird Add-ons Manager. If version is 10.0.4, system is vulnerable.Check Version:
No command-line check; verify through Thunderbird Add-ons Manager interface.Verify Fix Applied:
Verify ImportExportTools NG version is 10.0.5 or later in Add-ons Manager after update.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML export activities or errors in Thunderbird logs
Network Indicators:
- Incoming emails with suspicious HTML content in subjects
SIEM Query:
Email logs showing HTML export events from Thunderbird with ImportExportTools NG🔗 References
- https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/
- https://github.com/thundernest/import-export-tools-ng
- https://www.exploit-db.com/exploits/50496
- https://www.vulnerability-lab.com/get_content.php?id=2308
- https://www.exploit-db.com/exploits/50496
- https://www.vulnerability-lab.com/get_content.php?id=2308
