russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.7 KiB

Raw Permalink Blame History

Thunderbird — CWE-312 Disclosure Brief (thunderbird-0008)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One CWE-312 credential exposure defect in Thunderbird's OAuth2 implementation. requestAccessToken() logs the full OAuth2 response including access_token and refresh_token verbatim at log.info level. Patched.

The Defects

thunderbird-0008 (PATCHED — HIGH): mailnews/base/src/OAuth2.sys.mjs

// In requestAccessToken() — fires on every OAuth2 token exchange:
const resultStr = JSON.stringify(result);
// line 333:
log.info(`Error response details: ${resultStr}`);
// line 358:
log.info(`Successful response from the authorization server: ${resultStr}`);

A successful OAuth2 response always contains access_token and frequently refresh_token. When mailnews.oauth.loglevel is set to "All", "Debug", or "Info" (common during troubleshooting), these tokens are written to the application log and browser console.

access_token grants full mailbox access (Gmail, Microsoft 365, Fastmail)
refresh_token is long-lived and survives account password changes
Logging either constitutes CWE-312: credentials at rest in plaintext log files

Impact

Thunderbird supports OAuth2 for Gmail, Microsoft 365, Yahoo, and other major email providers. When users or developers enable log output for troubleshooting (a common support recommendation), bearer tokens granting full email account access are written in plaintext to log files. Crash reporters, log aggregators, syslog forwarding, or anyone with file system access can harvest these tokens.

The Fix

thunderbird-0008: Strip sensitive fields before logging:

// Before — logs credentials verbatim
const resultStr = JSON.stringify(result);

// After — redacts credential fields
const safeResult = Object.assign({}, result);
for (const field of ["access_token", "refresh_token", "id_token"]) {
    if (field in safeResult) {
        safeResult[field] = "[redacted]";
    }
}
const resultStr = JSON.stringify(safeResult);

Patch

Fix available: defects/thunderbird-0008/patch/thunderbird-0008_OAuth2_accessToken_logged_CWE312.patch

Single-file patch in mailnews/base/src/OAuth2.sys.mjs.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Bugzilla reference (bugzilla.mozilla.org).
Assess severity — logs live OAuth2 bearer tokens granting full email account access.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Thunderbird team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.7 KiB Raw Permalink Blame History