SecBoard
Zurück zur CVE-Übersicht

CVE-2026-113866

MEDIUM(5.9)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Risk Signal Score15/100 — NIEDRIG
  • CVSS 5.9 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.9

Technische Schwere

Beschreibung

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Thunderbird 158.0.1
  • Thunderbird 153.5.1

Threat-Hunting-Queries

Detection for unencrypted credential transmission during Exchange AutoDiscover setup. This requires network traffic monitoring to identify HTTP requests containing credentials to AutoDiscover services.

Sentinel/Defender KQL

let ExchangeAutoDiscoverTraffic = WireData
| where DstPort == 80 and Protocol == "http"
| where Payload contains "AutoDiscover" and Payload contains "Authorization: Basic";
ExchangeAutoDiscoverTraffic
| project TimeGenerated, SourceIp, DestinationIp, DstPort, Payload

Splunk SPL

sourcetype=bro:http (dest_port=80 OR port=80) (uri_path=*AutoDiscover* OR body=*AutoDiscover*) (http_header=*Authorization: Basic*)

Sigma

title: Thunderbird Unencrypted Exchange AutoDiscover Credentials
author: SecBoard
date: 2026/10/21
logsource:
  category: network_traffic
  product: any
detection:
  selection:
    protocol: http
    dest_port: 80
    http_uri|contains: 'AutoDiscover'
    http_header|contains: 'Authorization: Basic'
  condition: selection
fields:
  - source_ip
  - destination_ip
  - dest_port
  - http_uri
  - http_header
tags:
  - attack.credential_access
  - cve.2026.113866
level: high

Elastic ES|QL

FROM network_traffic
| WHERE http.request.method == 'GET' OR http.request.method == 'POST'
| WHERE destination.port == 80
| WHERE http.request.url.path LIKE '%AutoDiscover%'
| WHERE http.request.headers.authorization LIKE 'Basic %'
| SELECT @timestamp, source.ip, destination.ip, destination.port, http.request.url.path, http.request.headers.authorization

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen