I scanned a web app using Burp and it reported this vulnerability. When I click on the issue it show this request and response:
GET / HTTP/1.1 Host: xxxxx.burpcollaborator.net Pragma: no-cache Cache-Control: no-cache, no-transform Connection: close
HTTP/1.1 200 OK Server: Burp Collaborator https://burpcollaborator.net/ X-Collaborator-Version: 4 Content-Type: text/html Content-Length: 60 <html><body>blablalbalbalbalbalbalba</body></html>
When I send the request to repeater and send it, app server gives an error. Advisory says that Burp submitted the payload in the SSL SNI value and the HTTP Host header. I tried to do this manually using curl. I used examples from: https://www.claudiokuenzler.com/blog/693/curious-case-of-curl-ssl-tls-sni-http-host-header
curl --resolve xxxxx.burpcollaborator.net:80:myapp.com http://xxxxx.burpcollaborator.net
openssl s_client -connect myapp.com:443 -servername xxxxx.burpcollaborator.net
After running both of these command I checked burp collaborator client for IP addresses. It only shows my client IP. Server IP address is not included in any interaction.
So if the client is interacting with the alien server (burp in this case) what is the vulnerability in here? Should not it be the server's IP for this to become a vulnerability?