CVE-2021-29416: 
Burp Suite vulnerability analysis and mitigation

CVE-2021-29416 was discovered in PortSwigger Burp Suite before version 2021.2. The vulnerability could result in Burp Suite issuing requests that do not respect its upstream proxy configuration and could leak NetNTLM hashes on Windows systems that fail to block outbound SMB (PortSwigger Release).

The vulnerability was related to Burp Suite's handling of proxy configurations, where the application could bypass configured upstream proxy settings. On Windows systems without proper SMB blocking, this could lead to the exposure of NetNTLM hashes. The issue was discovered through PortSwigger's bug bounty program and fixed in version 2021.2 (PortSwigger Release).

The vulnerability could allow attackers to bypass proxy configurations and potentially capture NetNTLM authentication hashes from affected Windows systems. This could lead to unauthorized access or credential theft on systems that don't properly block outbound SMB traffic (PortSwigger Release).

The vulnerability was fixed in Burp Suite version 2021.2. Users should upgrade to this or a later version to protect against this vulnerability. Additionally, proper configuration of Windows systems to block outbound SMB traffic can help mitigate the risk (PortSwigger Release).