Critical severity · published Mar 24, 2023
CVE-2022-42948
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
In wildKEV
9.8
CVSS
2.7%
EPSS
Yes
On KEV
Description
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 30, 2023
Federal remediation dueApr 20, 2023
Ransomware campaign useNot known
Affected products
Which versions
CS
Cobalt Strike · Helpsystems
4.7.1 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-42948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-42948
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.cobaltstrike.com
https://www.cobaltstrike.com/blog/
www.redpacketsecurity.com
https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/
thesecmaster.com
https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/
More from Cobalt Strike
6.1
CVE-2022-39197
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
7.5
CVE-2022-23317
CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL
7.5
CVE-2021-36798
A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3