HexBrain

PortSwigger Web Security · Report #953219

SMTP interaction theft via MITM

Validstatus
mediumseverity
78upvotes
4 Nov 2020disclosed

Summary

@duesee found it was possible for an active MITM to inject a plaintext collaborator ID and use that to steal collaborator SMTP interactions We patched this in the following release: https://portswigger.net/burp/releases/professional-community-2020-9-2

This issue is closely related to CVE-2011-0411, and due to our non-standard SMTP implementation, some vulnerability scanners incorrectly flag the patched server as being vulnerable.

How it was found

See http://www.postfix.org/CVE-2011-0411.html for adetailled description.

Impact

MitM could obtain user credentials.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original