Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-03-30
• EPSS: 46% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

CISA: Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Apr 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1MitigationVendor Advisory
• www.cobaltstrike.com/blog/tag/releaseRelease NotesVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource