PortSwigger Web Security · Report #953219
SMTP interaction theft via MITM
Validstatus
mediumseverity
78upvotes
4 Nov 2020disclosed
Summary
@duesee found it was possible for an active MITM to inject a plaintext collaborator ID and use that to steal collaborator SMTP interactions We patched this in the following release: https://portswigger.net/burp/releases/professional-community-2020-9-2
This issue is closely related to CVE-2011-0411, and due to our non-standard SMTP implementation, some vulnerability scanners incorrectly flag the patched server as being vulnerable.
How it was found
See http://www.postfix.org/CVE-2011-0411.html for adetailled description.
Impact
MitM could obtain user credentials.