CVE-2025-3535 Overview
CVE-2025-3535 affects shuanx BurpAPIFinder versions up to 2.0.2. BurpAPIFinder is a Burp Suite extension used to discover and analyze API endpoints during web application testing. The vulnerability resides in unspecified functionality that processes the BurpApiFinder.db file. An attacker can manipulate this component remotely to trigger a denial of service condition. The issue is classified under CWE-404: Improper Resource Shutdown or Release. Public disclosure has occurred through both the project's GitHub issue tracker and VulDB entry 304573, meaning technical details are available to any attacker.
Critical Impact
Remote attackers can disrupt BurpAPIFinder availability by manipulating the BurpApiFinder.db file, interrupting API discovery workflows during security testing engagements.
Affected Products
- shuanx BurpAPIFinder versions up to and including 2.0.2
- Burp Suite instances running the vulnerable extension
- Security testing environments relying on BurpAPIFinder for API discovery
Discovery Timeline
- 2025-04-13 - CVE-2025-3535 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3535
Vulnerability Analysis
The flaw exists in an unspecified code path that handles the BurpApiFinder.db database file used by the extension to persist discovered API endpoints. According to the VulDB submission, manipulation of this file leads to a denial of service condition in the extension. The classification under CWE-404 indicates the extension fails to properly shut down or release a resource when processing malformed or manipulated database input.
The attack requires network reachability and some form of user participation, consistent with the extension's role in intercepting and processing web traffic. Successful exploitation degrades the availability of the API discovery workflow but does not directly compromise confidentiality or integrity of tested applications.
Root Cause
The root cause is improper resource handling ([CWE-404]) when the extension parses or interacts with the BurpApiFinder.db SQLite-style storage file. When the file contents are manipulated, the extension does not release associated resources cleanly, resulting in a service disruption. The vendor has not published a detailed root-cause analysis beyond the public GitHub issue.
Attack Vector
Exploitation occurs over the network against a testing workstation running BurpAPIFinder. An attacker delivers crafted content that influences the state of BurpApiFinder.db, causing the extension to enter a failed or unresponsive state. No authentication is required, but user interaction with the malicious content is a factor in the attack chain. No verified public exploit code or proof-of-concept repository is referenced in the CVE data beyond the descriptive GitHub issue.
Detection Methods for CVE-2025-3535
Indicators of Compromise
- Unexpected crashes, hangs, or errors reported by the BurpAPIFinder extension inside Burp Suite
- Modification, truncation, or corruption of the BurpApiFinder.db file outside normal testing activity
- Repeated failures or exceptions in Burp Suite extension logs referencing BurpAPIFinder
Detection Strategies
- Monitor file integrity on the BurpApiFinder.db file on analyst workstations and alert on unexpected writes
- Review Burp Suite extension error output for stack traces or resource-release failures tied to BurpAPIFinder
- Inventory Burp Suite installations and flag any BurpAPIFinder version at or below 2.0.2
Monitoring Recommendations
- Track process stability of Burp Suite on penetration tester endpoints and alert on repeated abnormal terminations
- Log outbound and inbound traffic during active testing sessions to correlate DoS events with suspicious payloads
- Include Burp Suite extension inventory in endpoint software audits to identify vulnerable BurpAPIFinder deployments
How to Mitigate CVE-2025-3535
Immediate Actions Required
- Identify all analyst systems running BurpAPIFinder version 2.0.2 or earlier and remove the extension until a fixed release is available
- Restrict testing workflows so BurpAPIFinder is only enabled against trusted scopes
- Back up and validate any existing BurpApiFinder.db files before reuse across sessions
Patch Information
At the time of the last NVD update on 2026-06-17, the CVE record does not reference a vendor patch commit or fixed release. Monitor the BurpAPIFinder GitHub issue #18 and project releases for a maintainer-issued fix. Apply any updated version published above 2.0.2 once it becomes available.
Workarounds
- Disable the BurpAPIFinder extension in Burp Suite until a patched release is available
- Delete or replace the BurpApiFinder.db file between engagements to avoid processing manipulated content
- Run Burp Suite with the extension only inside isolated virtual machines dedicated to a single engagement
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
