A URL disclosure issue was discovered in Burp Suite before 2022

CVE-2022-35406 affects Burp Suite Community and Professional before 2022.6. A malicious application can return a crafted response that Burp Repeater or Intruder misinterprets as a redirect when the analyst views it, causing unintended URL disclosure behavior inside the tester's workflow rather than a server-side compromise.

The published 4.3 / MEDIUM label is still too generous for patch triage at enterprise scale. The chain requires a human using a niche desktop security tool, pointing it at hostile content, and then viewing the crafted response in specific tabs; that is several layers of reachability friction before you get to an impact that is limited and non-persistent.

Why this verdict

• Requires human interaction: the user must view a crafted response in Repeater or Intruder, which is classic UI:R friction and blocks unattended exploitation.
• Requires a narrow attacker position: the adversary must control the target response path that a Burp analyst is testing, which implies a hostile test target or prior response tampering rather than broad internet reach.
• Exposure population is tiny: Burp is a specialist desktop tool, not something installed across 10,000 general endpoints or internet-facing servers.
• Impact is limited: this is URL disclosure / redirect misinterpretation, not RCE, auth bypass, credential dump, or domain-wide privilege escalation.
• No exploitation signal: no KEV entry, no public campaign reporting, and low EPSS all push the score down further.

Why not higher?

There is no server-side compromise path here. To get to impact, the attacker needs both analyst interaction and the specific Burp workflow, and even then the outcome is limited compared with vulnerabilities that hand over execution, credentials, or privileged access.

Why not lower?

It is still a real security defect in a widely used security testing tool, and some organizations do point Burp at hostile or semi-hostile targets routinely. If your appsec team handles sensitive internal URLs, the disclosure behavior has enough operational relevance to keep it out of full IGNORE territory.

1. Upgrade Burp on security workstations — Move all Burp Community and Professional installs to 2022.6 or later as normal tooling hygiene. Because this is a LOW verdict, there is no SLA beyond backlog management; fold it into the next routine workstation or developer-tool refresh cycle.
2. Restrict Burp use to managed analyst endpoints — Keep Burp on hardened, centrally managed appsec or pentest systems so version inventory is easy and the exposed population stays small. For a LOW verdict, do this as standard hardening work rather than emergency response.
3. Force outbound web traffic through logging proxies — Route analyst workstations through an egress proxy so unexpected outbound requests triggered during testing leave artifacts. That gives you at least some visibility if crafted responses cause odd redirect behavior; implement as normal control improvement, not as an urgent hotfix.
4. Educate testers on hostile-target handling — Remind Burp users that the target under test can be malicious too, especially in bug bounty or third-party assessment work. This reduces accidental trust in tool UI behavior while you clear old versions from the fleet.

Run this on the analyst workstation where Burp is installed, or from your software-audit tooling with file-system access to the Burp binary, installer, DMG, or JAR name. Invoke it with either a discovered version string or a Burp path, for example: python3 check_burp_cve_2022_35406.py /opt/BurpSuiteCommunity/burpsuite_community_v2022.5.jar or python3 check_burp_cve_2022_35406.py 2022.5; no admin rights are required unless your EDR blocks process execution.

#!/usr/bin/env python3
# check_burp_cve_2022_35406.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

import os
import re
import sys
import subprocess

FIXED_MAJOR = 2022
FIXED_MINOR = 6


def normalize_version(raw: str):
    if not raw:
        return None
    s = raw.strip()

    # Common Burp filename/version patterns:
    #   2022.6
    #   v2022.6
    #   v2022_6
    #   burpsuite_pro_v2022_6.jar
    m = re.search(r'(?:v)?(20\d{2})[._](\d+)', s)
    if m:
        return int(m.group(1)), int(m.group(2))

    # Fallback: any 4-digit year followed later by a dot/underscore and a minor
    m = re.search(r'(20\d{2}).*?[._](\d+)', s)
    if m:
        return int(m.group(1)), int(m.group(2))

    return None


def compare_version(ver):
    major, minor = ver
    if major < FIXED_MAJOR:
        return 'VULNERABLE'
    if major == FIXED_MAJOR and minor < FIXED_MINOR:
        return 'VULNERABLE'
    return 'PATCHED'


def try_command(path):
    candidates = [
        [path, '--version'],
        [path, '-version'],
        ['java', '-jar', path, '--version'],
        ['java', '-jar', path, '-version'],
    ]
    for cmd in candidates:
        try:
            proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=12)
            output = (proc.stdout or '') + '\n' + (proc.stderr or '')
            ver = normalize_version(output)
            if ver:
                return ver, ' '.join(cmd)
        except Exception:
            continue
    return None, None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN')
        print('Usage: python3 check_burp_cve_2022_35406.py <version-string-or-path>')
        sys.exit(2)

    arg = sys.argv[1]

    # If caller passed a raw version string
    ver = normalize_version(arg)
    if ver:
        result = compare_version(ver)
        print(result)
        print(f'Detected version: {ver[0]}.{ver[1]}')
        sys.exit(1 if result == 'VULNERABLE' else 0)

    # If caller passed a file path, inspect basename first
    if os.path.exists(arg):
        base = os.path.basename(arg)
        ver = normalize_version(base)
        if ver:
            result = compare_version(ver)
            print(result)
            print(f'Detected from filename: {base} -> {ver[0]}.{ver[1]}')
            sys.exit(1 if result == 'VULNERABLE' else 0)

        # Try executing/querying version
        ver, cmd = try_command(arg)
        if ver:
            result = compare_version(ver)
            print(result)
            print(f'Detected via command: {cmd} -> {ver[0]}.{ver[1]}')
            sys.exit(1 if result == 'VULNERABLE' else 0)

    print('UNKNOWN')
    print('Could not determine Burp version. Provide a Burp path whose filename includes the version, or pass the version string directly (example: 2022.5).')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. PortSwigger Burp Suite 2022.6 release notes
2. NVD CVE-2022-35406
3. CVE.org record for CVE-2022-35406
4. CISA Known Exploited Vulnerabilities catalog
5. FIRST EPSS data and statistics
6. PortSwigger Burp documentation contents (desktop editions)
7. PortSwigger Burp Repeater documentation
8. Security NEXT summary of CVE-2022-35406