Thunderbird has long been a preferred email client for those seeking security and privacy. But even trusted software can have vulnerabilities. One such serious bug was discovered under the ID CVE-2023-3417, where Thunderbird mishandled special Unicode characters in file names, allowing malicious attachments to hide in plain sight. In this guide, we break down how this flaw worked, what risks it created, and how you can protect yourself.

What Exactly Was the Problem?

Thunderbird did not properly handle a specific Unicode character called the Text Direction Override (U+202E). This invisible character can reverse the order in which text is displayed—so a file named "receiptcod.exe" could be shown as "receiptcod.exe" or, with some trickery, as "receiptcod.pdf".
This is a classic example of a "Right-to-Left Override" (RTLO) attack.

Hackers exploited this by sending emails with attachments that looked like harmless documents (PDF, DOCX), but were actually dangerous executables (.exe, .bat, etc.).

Example: How the Exploit Worked

Suppose an attacker wanted their attachment to appear as "report.pdf", but the actual file is named reportfdp.exe. Using the U+202E character, the attacker can swap the file extension position, so Thunderbird displays it as a PDF file to the recipient.

Unicode character used:  

U+202E  (Right-To-Left Override, or RLO)

Attack file name in code

# This is "report" + U+202E + "fdp" + ".exe", so it looks like "report.pdf.exe"
# With U+202E, the "fdp" gets reversed to "pdf"
filename = "report\u202Efdp.exe"

When attached, this shows up in older Thunderbird as

report.pdf.exe

But is rendered as

report.exe

Or, more sneakily, as

report.pdf


depending on the placement of the RLO character—making it look like a safe document when it's really a perilous executable.

Here's an actual code snippet to generate such a filename

filename = "invoice\u202Efdp.exe"
print(filename)       # Output: invoice‮fdp.exe
# In many email apps and on Windows, this will display as:
# invoice.pdf.exe, or even invoice.pdf with the base extension hidden.


When an unsuspecting user downloads and tries to open "invoice.pdf", it's really an executable—potentially installing malware or ransomware.

Antivirus and even some email security scanners might overlook the Unicode trick.

- Once opened, the executable could steal information, encrypt files, or give remote access to the attacker.

How Has Thunderbird Fixed It?

The Thunderbird team has resolved this issue in Thunderbird 115..1 and 102.13.1 and newer releases by stripping out the direction-override Unicode character. Now, you will always see the real file extension, no matter what tricks the sender tries.

Official patch note:  
> "Thunderbird will now remove direction-override Unicode characters in attachment filenames. Attachments will always show their true extension."

Double-check file extensions:

If you’re using another email client, be wary of files with strange or double extensions (e.g., docx.exe, pdf.bat).

Consider viewing attachments in a virtual machine or sandbox environment if unsure.

References

- Mozilla’s security advisory: Thunderbird Security Vulnerabilities fixed in Thunderbird 115..1
- CVE record: CVE-2023-3417 - NVD
- Unicode Right-to-Left Override: Wikipedia - Bidirectional Text

Final Notes

This flaw shows how even invisible differences (like hidden Unicode characters) can be exploited by cybercriminals. Always keep your software up to date and treat attachments with caution. Just because something looks like a document, doesn’t mean it’s safe—especially with tricks like CVE-2023-3417.

Timeline

Published on: 07/24/2023 11:15:00 UTC
Last modified on: 08/01/2023 17:53:00 UTC