Paper/Archive/CVE-2022-42948

CVE-2022-42948

Fortra Cobalt Strike — Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

KEV · due 20 Apr EPSS 3%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 85.9.859 × 2017.2 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refcobaltstrike.com/blog refredpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948 refthesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42948 kevcisa.gov/known-exploited-vulnerabilities-catalog