Issue
- Even if SSL (or TLS) is enabled, the login credentials are in plain text while intercepting requests with Burp Suite.
Environment
- Liferay DXP 7.3
Resolution
- If a user utilizes the burp suite as a proxy, they can see plain text in the password since the burp intercepts all traffic between the browser and the website, therefore it will generally examine the traffic. Bypassing TLS* protection with the Burp settings is not considered a vulnerability.
- Since the page transmits the password via HTTPS, it's encrypted before being sent on the network. Now, if users allowed Burp to decrypt any encrypted traffic by adding their certificate into the trusted certificates store, that's the only reason why Burp can perform a man-in-the-middle attack and see the password in plaintext format. Anyone else will only see encrypted traffic, and won't even be able to tell if a password is being transmitted: Password shows as plaintext via burp suite interception for HTTPS request, is it an issue?
- In this case, a user needs to remove the Burp CA certificate from their browser to modify this behavior, which will also make Burp rather useless: Installing Burp's CA certificate
Additional Information
- SSL is outdated and unsafe, therefore it should not be used. The data could be decrypted if a user is using SSL (though we're quite sure Burp doesn't support SSL decryption): https://help.liferay.com/hc/en-us/articles/360019140811
-
Password is visible as a plain text in the user's browser console