Embed Notice

@jabberati @feld
they attacker could try send valid XMPP stanzas unencrypted, together with the starttls and a buggy server may interpret them as part of the encrypted and authenticated connection after starttls.

If a server has a bug like that, an attacker in a MITM position can inject stanzas into client's session without actually MITMing the TLS.

this blog has an example for SMTP:

https://blog.apnic.net/2021/11/18/vulnerabilities-show-why-starttls-should-be-avoided-if-possible/
(haven't read the whole blog post, only the example SMTP exchange)