Closed Bug 1952574 Opened 1 year ago Closed 1 year ago

Thunderbird fails to login using IMAP if the password contains double quote character, "

Categories

(Thunderbird :: Security, defect)

Product:
Thunderbird
Component:
Security
Version:
Thunderbird 115
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED INVALID

People

(Reporter: bluefusion64, Unassigned)

Details

Steps to reproduce:

I tried to connect to a imap server using the following password:
SDT&`"IZl;R]L~,!|?7k

Port: 993
Security: SSL/TLS
Authentication method: Regular password

Environment:
Thunderbird 115.18.0 in Linux Mint 21.3

I also tried the flatpak version 128.8.0esr but it has the same problem.

Actual results:

Thunderbird complains that the password is wrong (but it is not, as I can login just fine using openssl in the linux terminal: openssl s_client -connect example-host-domain.com:993 -crlf, and then doing the login there)

Expected results:

The login should have been successful. Changing the password to:
SDT&`uIZl;R]L~,!|?7k
(changed the " to u)
in both the server and thunderbird makes it to work.

Interestingly even with the password that does not work, if I change the protocol to pop3 it also works... it only fails in imap.

Not sure if relevant but I am using the XFCE version of Linux Mint 21.3.

Component: Account Manager → Networking
Product: Thunderbird → MailNews Core
Status: NEW → UNCONFIRMED
Component: Account Manager → Networking
Ever confirmed: false
Component: Networking → Security
Product: MailNews Core → Thunderbird
Summary: Thunderbird fails to login using IMAP using specific password → Thunderbird fails to login using IMAP if the password contains double quote character, "

Could we get help in getting this issue confirmed, whether we can reproduce, whether it's happening with any IMAP server, or just with some?

Could we get help in getting this issue confirmed, whether we can reproduce, whether it's happening with any IMAP server, or just with some?

Sure. Maybe I can setup a temporary email account with imap access where this issue can be reproduced? Let me know an email (or other means) where I can send you the imap account information, so you can try to reproduce it in your side.

(In reply to Kai Engert [:KaiE:] from comment #3)

Could we get help in getting this issue confirmed, whether we can reproduce, whether it's happening with any IMAP server, or just with some?

Let me try with a google account imap, to see if the same problem also happens there...

Ok, I have done some more digging into this issue.

I tried to use a gmail account but seems they don't support imap anymore, so I tried another third party and it just worked! The issue didn't occur with their server.

I checked again in my current server and I created other account where the problem also did not accur, then I created a similar email to the one that I have and I was able to reproduce the issue again. So it seems to only happen in this specific imap server and for some usernames... It's a bit strange.

I tried to login with openssl into this imap account that thunderbird is unable to login and with openssl it just works, I can read the email without any issues.

Could you please try to debug the issue with the temporary imap account that I created in this specific server (where the issue is reproducible)?

I can send you the details privately (just let me know how). In thunderbird it is not possible to login but using openssl as described here:
https://stackoverflow.com/a/14959548

It just works.

I can also reproduce the issue on Thunderbird 136 in Windows 11. There is a let's encrypt issue also, but that may require a separate bug.

Also please ignore the "let's encrypt issue", it was a certificate problem that I just got fixed by the email company. But the login issue with thunderbird with this specific imap server, username and password remains.

Thanks for the updates.

Given that the character works with other email servers, it shows that thunderbird can correctly transport it to servers in general.

It seems currently more likely that it is a bug of the server software.

Can you share what kind of server software is used on the nonworking server?

To be honest I don't know what server software they are using... I can try to ask them, not sure if they will reply that. Or I could give you the details for you to check the offending account directly. I find it strange though that it works with openssl in the terminal.

Hello!

We have tried but eren't able to reproduce this issue.
We have used an IMAP account(gmail) on Linux Mint 22 Cinnamon with X11 and Win 11 with the following TB versions.

  • 115.18.0(20241211204238)
  • 128.8.0esr (20250228160316)
  • 137.0b1 (20250307105646)

Get an IMAP protocol log. https://wiki.mozilla.org/MailNews:Logging
Which server software is used will usually be pretty clearly announced in the protocol greeting.

Thanks for the support and testing.

I checked the thunderbird imap log and the greeting only contains:
"* OK imap server ready for requests"

Also I checked in the log what the server returns when thunderbird fails to login and it returns this:
"NO authenticate not a valid base64 argument"
"authlogin failed"
"D/IMAP Marking auth method 0x1000 failed"
and after
"Trying auth method 0x4"
"old-style auth"
"NO login invalid login details"
"IMAP: ask user what to do (after login failed): new passwort, retry, cancel"

I also tried other email clients: evolution, geary and mailspring. All failed like thunderbird.

Interestingly I found out why mailspring is failing by looking at their log:
2 LOGIN "bluefusion63@masked-server-address.net" "SDT&`"IZl;R]L~,!|?7k"
2 NO LOGIN invalid login details

When I try to connect through openssl using what mailspring used above I also get the same error, I need to execute the command with the password without outer quotes for it to work:
2 LOGIN "bluefusion63@masked-server-address.net" SDT&`"IZl;R]L~,!|?7k

  • CAPABILITY IMAP4rev1 MOVE IDLE UTF8=ACCEPT ID ENABLE UIDPLUS
    a001 OK login successfully logged in

I will ask the company what server are they using. I will see if they can help us with that.

Just an update.

So I asked for help at the email company and they told me that the imap software is an in house product.

I then asked them to check to see if this is a bug on their software or not and they told me that their email team said that "some email clients have their own detection methods and may not recognize quote character (")". Though I don't think this is the issue with thunderbird as it works with other email providers with quotes (") in the passwords.

They said that they will show an error for accounts that try to use the quote character (") in their passwords.

So, as far I can tell, it seems that the issue is in their custom imap server solution. As I couldn't reproduce the issue with other provider (and neither did you).

I greatly appreciate your support and I will close this issue.

Thank you.

Status: UNCONFIRMED → RESOLVED
Closed: 1 year ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.