CVE-2022-39197mediumunder attackCWE-79

CVE-2022-39197

Published · Updated

Follow this CVE+ Monitor Cobalt Strike

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 6.1epss 44%
from disclosure to weaponsame day
Published on NVDSep 22
1st PoCJul 17
CISA KEV+189d
Action required by CISAfederal deadline: 2023-04-20

Apply updates per vendor instructions.

In short

Cobalt Strike teamserver versions up to 4.7 have an XSS vulnerability that allows attackers to inject harmful HTML code by modifying the username field in a payload. This could enable attackers to execute malicious scripts on the server if they can access and modify payloads.

Technical detail

An XSS vulnerability exists in the payload inspection functionality where the username field is not properly sanitized before rendering in the teamserver interface. An attacker with access to inspect or create payloads can inject malicious HTML/JavaScript by crafting a malformed username field, leading to code execution in the server context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.