1521611 - Phishing Attack with special characters in Mozilla Thunderbird (spoofing e-mail sender)

Status: RESOLVED DUPLICATE of bug 1506587

(Thunderbird :: Security, defect)

Description

[Artur]

Attachment: POC_1.jpg

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Steps to reproduce:

1. VULNERABILITY DETAILS:

I have identified the possibility of deceiving the user regarding the person who sent the e-mail.
An attacker using a "few" special characters is able to create a quite convincing image of the e-mail sender.

Actual results:

2. PROOF OF CONCEPT:
   Step by step:
   a) The attacker wants to impersonate/spoof the e-mail address: [e-mail]
   b) The attacker on his e-mail sets the following payload in the "Display Name"/"Name and Surname" field:
   10000SpacesInName\u0020<[e-mail]>[64 x \u3000][15595 x \u3000][1 x \u0000]

Full name field is in file "e-mail_name_16000_chars.txt".

c) Then the attacker sends an e-mail to the victim of the attack.
d) The victim of the attack sees such an e-mail (picture: POC_1.jpg, POC_2.jpg and POC_3.jpg).

We can observe that even when a victim responds to an email he does not see a real email (POC_3.jpg).

3 special characters were used there:

• 'IDEOGRAPHIC SPACE' (U+3000)
• 'SPACE' (U+0020)
• 'NULL' (U+0000)

3. VERSION:
   a) PC
   Mozilla Thunderbird Version: 60.4.0
   Operating System: Windows 7 SP1 (fully updated)

Expected results:

4. RECOMENDATION:
   All special characters should be properly filtered and cleaned before displaying. In addition, with long names in e-mail, it is recommended to use the display rule "X characters of the name ... <[e-mail]>" - so that you always display the real e-mail address at the end.

====

If in any way I can help, please contact me.

Best Regards and thank you for your reply,
Artur

Comment 1

[Artur]

Attachment: e-mail_name_16000_chars.txt

Comment 2

[Artur]

Attachment: POC_2.jpg

Comment 3

[Artur]

Attachment: POC_3.jpg

Comment 4

[Artur]

P.S. I'm sorry. In section "PROOF OF CONCEPT" should be:
10000SpacesInName\u0020<[e-mail]>[64 x \u3000][15595 x \u0020][1 x \u0000]

Comment 5

[Magnus Melin [:mkmelin]]

Already working on this in bug 1506587. (The WIP patch should already fix this particular test case.)