Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Weak Diffie-Hellman Moduli (logjam)

Ken | Last updated: Jan 18, 2022 09:41AM UTC

During a recent external pen test our Burp Collaborator server was identified as being vulnerable to "Weak Diffie-Hellman Moduli (logjam)". I appreciate that in general terms this isn't a problem as Burp Collaborator is a pen testing tool, however having reviewed the available configuration options (https://portswigger.net/burp/documentation/collaborator/deploying#tls-configuration was one page, I reviewed many) I'm unable to see configuration options available to influence Diffie-Hellman parameters or the ciphers made available. https://weakdh.org/sysadmin.html Any help gratefully received!

Liam, PortSwigger Agent | Last updated: Jan 18, 2022 02:07PM UTC

Hi Ken. I've discussed this with our research team, they don't think it is a very serious concern. However, they have advised that we add a ticket to our development backlog to make this configurable. This will allow users to configure ciphers as they can in Burp or provide a ‘secure’ mode that does it automatically. We'll update this thread with any developments.

Ogle, | Last updated: Oct 11, 2022 06:56PM UTC

I fixed a similar issue with the BurpSuite Enterprise web server itself. You can probably adapt this to the Collaborator server. This is how I fixed the web server: I changed the echo and exec lines in burpsuite_interprise/webServer/component.sh: From: echo "$JRE_HOME/bin/java -cp lib/* -Dlogback.configurationFile=$LOGBACK_FILE -DlogsDirectory=$LOG_DIR -Djava.security.egd=file:///dev/urandom $MAIN_CLASS" exec "$JRE_HOME/bin/java" -cp "lib/*" -Dlogback.configurationFile=$LOGBACK_FILE -DlogsDirectory="$LOG_DIR" -Djava.security.egd=file:///dev/urandom $MAIN_CLASS To: echo "$JRE_HOME/bin/java -cp lib/* -Dlogback.configurationFile=$LOGBACK_FILE -DlogsDirectory=$LOG_DIR -Djava.security.egd=file:///dev/urandom -Djdk.tls.ephemeralDHKeySize=2048 $MAIN_CLASS" exec "$JRE_HOME/bin/java" -cp "lib/*" -Dlogback.configurationFile=$LOGBACK_FILE -DlogsDirectory="$LOG_DIR" -Djava.security.egd=file:///dev/urandom -Djdk.tls.ephemeralDHKeySize=2048 $MAIN_CLASS I ran a test with testssl.sh, and I got this result: LOGJAM (CVE-2015-4000), experimental common prime with 2048 bits detected: RFC7919/ffdhe2048 (2048 bits), but no DH EXPORT ciphers

Liam, PortSwigger Agent | Last updated: Oct 12, 2022 12:13PM UTC