Let’s consider this scenario:
An attacker got a valid certificate for a HSTS protected domain https://example.com. Can he still perform a man-in-the middle attack even if the website is already loaded in the browser HSTS list?
I remember using Burp suíte once and getting a strict transport security related error for a valid certificate, so I would suppose the HSTS list also contain the certificate fingerprint, although I could not find anything about it in the RFC
HSTS does not contain any kind of fingerprint (that would be HPKP instead). It only says that the site has to be loaded with HTTPS and that the certificate has to be trusted directly, i.e. no bypass of warnings by the user should be allowed. Insofar HSTS does not prevent MITM if the attacker can use a valid certificate which was issued by a CA trusted by the client.
It is unclear what you've exactly seen with Burp suite but maybe you were used to just bypass certificate warnings when using Burp instead of importing the CA of Burp as trusted, and bypassing certificate warnings no longer works with HSTS.
