CVE-2025-8036
📋 TL;DR
This vulnerability in Thunderbird and Firefox allows attackers to bypass Cross-Origin Resource Sharing (CORS) protections using DNS rebinding attacks. By exploiting cached CORS preflight responses across IP address changes, attackers can make unauthorized cross-origin requests to internal network resources. This affects users of Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Firefox ESR
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal network resources, steal authentication tokens, perform unauthorized actions on internal applications, and potentially pivot to other systems.
Likely Case
Attackers could access internal web applications, APIs, or services that rely on CORS protections, potentially stealing data or performing limited unauthorized actions.
If Mitigated
With proper network segmentation and additional authentication layers, impact is limited to specific exposed services within the same network segment.
🎯 Exploit Status
Exploitation requires DNS rebinding capabilities and user interaction. The vulnerability is publicly disclosed but no known public exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 141, Firefox ESR 140.1, Thunderbird 141, Thunderbird 140.1
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-56/
Restart Required: Yes
Instructions:
1. Open the application (Firefox or Thunderbird). 2. Go to Help > About Firefox/Thunderbird. 3. The application will automatically check for updates and prompt to install. 4. Restart the application after update completes.
🔧 Temporary Workarounds
Disable JavaScript
allTemporarily disable JavaScript to prevent exploitation, though this breaks most web functionality.
Use DNS filtering
allImplement DNS filtering to block known malicious domains and prevent DNS rebinding attacks.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate internal resources from user workstations
- Deploy additional authentication mechanisms for internal applications beyond CORS protections
🔍 How to Verify
Check if Vulnerable:
Check the application version in Help > About Firefox/Thunderbird. If version is below the patched versions listed, the system is vulnerable.Check Version:
firefox --version (Linux) or check About dialog (Windows/macOS)Verify Fix Applied:
After updating, verify the version shows Firefox 141+, Firefox ESR 140.1+, Thunderbird 141+, or Thunderbird 140.1+.📡 Detection & Monitoring
Log Indicators:
- Unusual cross-origin requests from user workstations to internal resources
- Multiple failed CORS preflight requests followed by successful requests
Network Indicators:
- DNS queries to suspicious domains followed by requests to internal IPs
- Unusual traffic patterns from browsers to internal services
SIEM Query:
source="browser_logs" AND (event="CORS_preflight" OR event="cross_origin_request") AND dest_ip=internal_subnet🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1960834
- https://www.mozilla.org/security/advisories/mfsa2025-56/
- https://www.mozilla.org/security/advisories/mfsa2025-59/
- https://www.mozilla.org/security/advisories/mfsa2025-61/
- https://www.mozilla.org/security/advisories/mfsa2025-63/
- https://www.kb.cert.org/vuls/id/652514
