A critical security flaw in Mozilla Thunderbird allows unauthenticated remote attackers to bypass attachment hostname restrictions, leading to potential unauthorized information disclosure.

This is an improper input validation vulnerability where the mail.allowed_attachment_hostnames advanced configuration setting is processed using an unescaped regular expression. An unauthenticated attacker can leverage this weakness to serve malicious remote attachments by bypassing defined hostname constraints.

The ability for an attacker to bypass attachment host filtering significantly increases the risk of phishing, malware delivery, and unauthorized remote data access. With a CVSS score of 7.5, this vulnerability presents a high risk to organizational security, as it facilitates the retrieval of external content that should otherwise be blocked. Successful exploitation could lead to sensitive data exposure or the compromise of local user systems via malicious attachments.

Immediate Action: Update Mozilla Thunderbird to version 153.2, 155, or any subsequent release to apply the necessary regex escaping fixes.

Proactive Monitoring: Review mail server and proxy logs for connections to unauthorized or suspicious external domains that were previously restricted by the attachment hostname configuration.

Compensating Controls: If immediate patching is not feasible, restrict the use of remote attachments and disable the automatic loading of external content within Thunderbird until the update can be applied.

Public Exploit Available: No

Given the high CVSS severity and the nature of the flaw, organizations should prioritize updating Thunderbird installations across their environment immediately. Failure to apply these updates leaves users vulnerable to bypasses that can be used to deliver malicious content directly into the mail client. Ensure all endpoints are brought to the fixed version to neutralize this vector.