cyfenced.com →

[ CVE-2022-42948 · Published 24 Mar 2023 ]

Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 3%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-03-30
  • Critical severity: CVSS 9.8

[ Description ]Official description

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

CISA: Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Apr 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References