SecBoard
Zurück zur CVE-Übersicht

CVE-2026-118177

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Risk Signal Score23/100 — NIEDRIG
  • CVSS 9.1 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.1

Technische Schwere

Beschreibung

When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Thunderbird 159

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName == "thunderbird.exe"
| where RemoteUrl contains "http://" or RemoteUrl contains "file://" or RemoteUrl contains "\\"
| where RemotePort == 80 or RemotePort == 445
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| summarize count() by RemoteUrl, RemoteIP, InitiatingProcessFileName

Splunk SPL

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3 Image="*\\thunderbird.exe" (DestinationPort=80 OR DestinationPort=445) (DestinationUrl="http://*" OR DestinationUrl="file://*" OR DestinationUrl="\\*")
| table _time, Host, Image, DestinationUrl, DestinationIP, DestinationPort, CommandLine, ParentImage

Sigma

title: Thunderbird Calendar Discovery Vulnerability
id: 9a1b3c4d-5e6f-7890-1234-567890abcdef
status: experimental
description: Detects Thunderbird attempting to access potentially malicious calendar locations via HTTP, local files, or network shares.
author: SecBoard
date: 2026/10/27
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\\thunderbird.exe'
    DestinationPort:
      - 80
      - 445
    DestinationUrl|contains:
      - 'http://'
      - 'file://'
      - '\\'
  condition: selection
fields:
  - Image
  - DestinationUrl
  - DestinationIP
  - DestinationPort
  - CommandLine
  - ParentImage
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.118177
  - exploitation

Elastic ES|QL

from network where process.executable.endswith("thunderbird.exe") and (destination.port == 80 or destination.port == 445) and (destination.url.full like "http://%" or destination.url.full like "file://%" or destination.url.full like "\\%")
| select @timestamp, host.name, process.executable, destination.url.full, destination.ip, destination.port, process.command_line, process.parent.executable

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen