Professional / Community 2021.8
Summary: PortSwigger released Burp Suite Professional and Community 2021.8 on 5 August 2021, adding native HTTP/2 support in Repeater, Proxy Intercept and the Inspector so testers can switch between HTTP/1 and HTTP/2 and build HTTP/2-exclusive attacks. The release also updated the embedded browser to Chromium 92.0.4515.131 to fix a clickjacking-based remote code execution bug reported through the bug bounty program by @mattaustin and @DanAmodio, and fixed bugs in recorded login playback.
Key Takeaway: The HTTP/2 attack surface had barely been audited because no suitable tooling existed, and the release ties its new capabilities to James Kettle's Black Hat USA 2021 research on HTTP/2-exclusive vulnerabilities. The embedded browser flaw was a clickjacking-based remote code execution bug in Burp Suite itself, found by two external researchers.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026