Fortra · Cobalt Strike
A cross-site scripting flaw in Fortra's Cobalt Strike teamserver, present in HelpSystems Cobalt Strike through version 4.7, lets a remote attacker inject HTML into the teamserver's interface via the username field of a payload. Exploitation requires that the attacker first inspect a Cobalt Strike payload and then modify its username field (or generate a new payload with the extracted information and alter that field to be malformed), with the attacker needing no authentication but requiring a user to interact with the crafted content.
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).
First seen exploited 4 months after disclosure. Public exploit code (PoC-in-GitHub) was available 1 day before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This vulnerability is exploited by a remote attacker to execute HTML on the Cobalt Strike team server. To exploit this vulnerability, an attacker would inspect a Cobalt Strike payload and modify the username field within the payload to be malformed. This manipulation enables the attacker to execute arbitrary code by setting a malformed username in the Beacon configuration. In a documented cybersecurity incident, a Chinese threat actor leveraged a modified version of Cobalt Strike, known as "Cobalt Strike Cat," which included a patch for CVE-2022-39197. This version was used to establish communication channels with victim systems, perform evasive post-exploitation activities, and maintain persistence.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2022-39197 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Patch for publicly available Cobalt Strike vulnerability tracked as CVE-2022-39197.Figure 8 shows a small portion of Cobalt Strike Cat logs from the attacker´s infrastructure.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.