Actively exploited · Published Mar 24, 2023 · Assigned by mitre
CVE-2022-42948
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Cobalt Strike from Fortra. Attackers are actively exploiting it in the wild (listed by CISA on March 30, 2023). The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 20, 2023.
Official description
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Affected products (as reported)
Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cobaltstrike.com/blog/
- https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/
- https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42948 government-resource