Tutao Tutanota up to 119.9 server-side request forgery

Summaryinfo

A vulnerability was found in Tutao Tutanota up to 119.9. It has been rated as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2024-23330. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Tutao Tutanota up to 119.9. This issue affects an unknown function. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality. The summary by CVE is:

Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even though the "Automatic Reloading of Images" function is disabled by default. The reloading is also done unencrypted via HTTP and redirections are followed. This behavior is unexpected for the user, since the user assumes that external content will only be loaded after explicit manual confirmation. The loading of external content in e-mails represents a risk, because this makes the sender aware that the e-mail address is used, when the e-mail was read, which device is used and expose the user's IP address. Version 119.10 contains a patch for this issue.

The weakness was disclosed 01/23/2024 as GHSA-32w8-v5fc-vpp7. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-23330 since 01/15/2024. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 119.10 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Tutao

Name

• Tutanota

Version

• 119.0
• 119.1
• 119.2
• 119.3
• 119.4
• 119.5
• 119.6
• 119.7
• 119.8
• 119.9

Website

• Product: https://github.com/tutao/tutanota/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion