CVE-2022-42948criticalunder attackCWE-116

CVE-2022-42948

Published · Updated

Follow this CVE+ Monitor Cobalt Strike

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 2.7%
from disclosure to weapon
Published on NVDMar 24
CISA KEV+6d
Action required by CISAfederal deadline: 2023-04-20

Apply updates per vendor instructions.

In short

Cobalt Strike 4.7.1 doesn't properly filter HTML code in its user interface, allowing attackers to inject malicious HTML that executes code when displayed. This lets remote attackers take control of the Cobalt Strike application itself.

Technical detail

CWE-116 (improper encoding/escaping) vulnerability in Cobalt Strike 4.7.1's Swing components allows HTML injection via unsanitized input. An attacker can craft malicious HTML payloads that execute arbitrary code within the Cobalt Strike UI context when rendered, requiring only the ability to send data displayed in the interface.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a