CVE-2025-8036: Critical Thunderbird CORS Preflight Response Caching Vulnerability

Overview

The Common Vulnerabilities and Exposures (CVE) system has recently identified a critical vulnerability, CVE-2025-8036, in Thunderbird that has significant implications for user security. This flaw affects Firefox and Thunderbird versions prior to 141 and Firefox ESR versions prior to 140.1. It centers on the caching of CORS preflight responses across IP address changes, thereby enabling DNS rebinding and circumvention of CORS. Given the widespread use of these products, the vulnerability has the potential to impact a large number of users. It matters because it can potentially lead to system compromise or data leakage, posing a serious threat to user privacy and security.

Vulnerability Summary

CVE ID: CVE-2025-8036
Severity: Critical (8.1 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise or data leakage due to circumvention of CORS

Affected Products

Product | Affected Versions

Firefox | < 141 Firefox ESR | < 140.1 Thunderbird | < 141 Thunderbird ESR | < 140.1 How the Exploit Works

The exploit makes use of the fact that Thunderbird caches CORS preflight responses across IP address changes. An attacker can manipulate this flaw by rebinding the DNS to a different IP address. This can lead to circumvention of the CORS policy, allowing a malicious website to send requests to a targeted web application without the application’s consent, leading to potential system compromise or data leakage.

Conceptual Example Code

Below is a conceptual example of how an attacker might exploit this vulnerability. Note that this is a simplified representation and actual exploitation would require a more complex approach.

GET /malicious/rebind HTTP/1.1
Host: evil.example.com
Content-Type: application/json
{ "dns_rebind": "target.example.com to new IP" }

Upon successful execution of this request, the attacker will have circumvented the CORS policy and can now send requests to `target.example.com` from `evil.example.com`.
It is important to note that while this example outlines the basic mechanism of the exploit, real-world exploitation would involve additional complexities and technical knowledge. All users of the affected products are strongly urged to apply the vendor patch or utilize a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation measure.