598988 - Spool URL in email content if sending email as HTML

Status: RESOLVED INVALID

(Thunderbird :: General, defect)

Description

[Tony Oslund]

User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MDDS; .NET4.0C)
Build Identifier: Thunderbird 3.1.4

If forwarding emails containing URL links as inline, and sending emails as HTML, it is possible to re-forward the email with spoofed URL links

Reproducible: Always

Steps to Reproduce:
1.Send HTML EMAIL to yourself using Thunderbird that contains a URL link
2.Re-forward this email (as inline) to yourself, modify URL slightly
3. Open re-forwarded email... displayed url is correct, actual url is url from original email
Actual Results:  
forwarded email appears to have newly modifed url, but url actually points to original url

Expected Results:  
forwarded email should both display the newly modified url and link to the newly modified url

Could be used to trick users into accessing bad web sites.

Set original html email up with bad web site, send email to yourself, modify email after received to appear to point to safe web site, re-forward this email to others as html email.  Email will look like it is pointing to a safe web site when in fact it is not.

Comment 1

[Daniel Veditz [:dveditz]]

Why bother with the forwarding, why not just create a link that points one place while claiming to go somewhere else in the link text? That's what the phishers do, after all.

There's nothing magic about email that prevents people fron lying. Their words can be a lie ("I need your help to transfer $20 million dollars out of Nigeria") and their links can be a lie. Thunderbird tries to make it easier to do the right thing than not, but there's no point in making it foolproof because the underlying mail system is insecure.