--- type: Article title: "Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling" description: Traces attacker-controlled file-input metadata through a browser-powered crawler into local file creation. An unchecked extension/path allows a generated upload file to escape its temporary directory, with a Windows Startup example demonstrating delayed execution at a later login under the scanner user’s permissions. resource: "https://hackerone.com/reports/3712279" tags: [article, webseclist-reference, hackerone, path-traversal, file-upload, rce, bug-bounty, case-study, owasp-a01-2021] generated: by: webseclist-refs/1 at: "2026-09-13T22:20:44+00:00" verified: - by: AI archive validation at: 2026-09-13 status: stable stale_after: 2027-09-13 sources: - id: original resource: "https://hackerone.com/reports/3712279" title: "Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling" author: Masahiro Kawada (kawakatz) also_at: [] authors: - Masahiro Kawada (kawakatz) canonical_url: "" cited_by: - "2026-ai.md:220" commit: "" content_sha256: a7f08c4aab6aac104551be3cf4dd34e6c56015bd279809665ddffc6e9078d2a5 depth: full depth_reason: default kind: article language: "" licence: unknown original_url: "https://hackerone.com/reports/3712279" published: "" publisher: HackerOne publisher_english: "" raw_sha256: "" retrieved_from: "https://hackerone.com/reports/3712279" retrieved_kind: manual-import retrieved_utc: "2026-09-13T22:20:44+00:00" slug: hackerone-burp-suite-professional-browser-powered-crawl-can-write-handling snapshot: "" title_english: "" translation_file: "" translation_of: "" --- # Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling **Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling** - Masahiro Kawada (kawakatz), HackerOne. - Published: date not stated - Original: - Preserved from: https://hackerone.com/reports/3712279 (manual-import) on 2026-09-13 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. # Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling Author: kawakatz (Masahiro Kawada, as credited in the vendor release). Source: https://hackerone.com/reports/3712279 Submitted privately: 2026-05-04T13:17:29.727Z Publicly disclosed: 2026-06-14T08:08:52.761Z ## Target Burp Suite Professional 2026.3.3 on Windows. ## Summary When Burp Scanner's browser-powered crawler crawls an attacker's website, the website can force Burp to write an attacker-controlled file to an attacker-controlled local path. For example, the PoC writes `calc.exe` into the current user's Startup folder, which triggers command execution when the user next logs in. The issue is caused by Burp's handling of ``: Burp creates a local upload file from page-controlled attributes, but does not prevent path traversal in the generated filename. ## Steps To Reproduce 1. Serve the following HTML from an attacker-controlled website: ```html ``` In my local reproduction, I served this file as: ```powershell python -m http.server 8000 ``` ```text http://192.168.186.149:8000/poc_file_input_write_startup_calc.html ``` 2. In Burp Suite Professional, start a new crawl: ```text Dashboard -> New scan -> Crawl URLs to scan -> http://192.168.186.149:8000/poc_file_input_write_startup_calc.html // to make it clear Scan configuration -> Deep -> Crawl configuration -> Browser behaviour -> Always use Burps' browser ``` 3. Start the crawl. 4. After the crawl processes the page, check the current user's Startup folder: ```text C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\burp_calc.bat ``` Observed result: ```text calc.exe ``` 5. Log out and log in again. `calc.exe` is executed from the Startup folder. ## Root Cause The root cause is that Burp treats untrusted web page attributes as safe local file metadata. The following snippets are from the decompiled Burp code, but I have renamed the obfuscated class, method, and variable names for readability. The logic is unchanged. When the crawler interacts with a form, it detects file inputs and calls the file-input preparation code: ```java for (FormInput input : discoveredInputs) { if (input.type() == InputType.FILE) { prepareFileInput(input); continue; } fillNormalInput(input); } ``` The file-input preparation code creates a local file, writes the page-controlled input value into it, then selects that file in the browser: ```java private static void prepareFileInput(FormInput input) throws IOException { if (isBlank(input.inputValue())) { return; } File uploadFile = buildTemporaryUploadFile(input); Files.write(uploadFile.toPath(), bytes(input.inputValue())); BrowserFileInput browserFileInput = input.browserElement().fileInput(); browserFileInput.selectFile(uploadFile.toPath()); } ``` The local file path is built by creating a temporary directory and resolving the derived filename beneath it: ```java private static File buildTemporaryUploadFile(FormInput input) throws IOException { String filename = input.deriveFileNameFromFileInput().orElse("file"); Path tempDirectory = Files.createTempDirectory("burp"); return tempDirectory.resolve(filename).toFile(); } ``` The unsafe filename comes from the file input's `accept` attribute. Burp accepts any token beginning with `.` as an extension: ```java private Optional deriveFileNameFromFileInput() { if (input.type() != InputType.FILE) { return Optional.empty(); } String accept = input.attribute("accept"); for (String token : accept.split(",")) { if (token.startsWith(".")) { fileNameBuilder.addExtension(token); } } return Optional.of(fileNameBuilder.build()); } ``` As a result, `Path.resolve(filename)` is used with attacker-controlled path traversal content. ## Recommended Fix Burp should not use page-controlled file input metadata directly as a local filesystem path. At minimum, the filename used for temporary upload files should be generated or sanitized so that a web page cannot introduce path separators, traversal sequences, or any value that escapes Burp's intended temporary directory. ## Impact A website accessed through Burp Scanner can write attacker-controlled text files to arbitrary user-writable locations where the parent directory already exists. On Windows, this can be used to write a `.bat` file to the current user's Startup folder. That file runs when the user next logs in, giving delayed code execution. This matches the High severity example in the bounty guidelines: ```text A website accessed through Burp Suite can make Burp execute arbitrary code ``` The guidelines also state: ```text Websites accessed through Burp are untrusted, so anything a website could do to read files of the user's computer, read data out of Burp Suite, or gain remote code execution would be considered a vulnerability. ```