CVE-2022-42948: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Other sources
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure text displayed in Swing components is properly escaped or disable HTML rendering for untrusted content. Sanitize or strip HTML tags before passing data to Swing UI components to prevent interpretation of injected HTML.
Cobalt Strike User Interface (Java Swing) HTML rendering / escaping = escape or disable HTML rendering for displayed text - Compensating control
Restrict access to the Cobalt Strike user interface to trusted administrators only (for example via firewall rules, VPN, or network segmentation) and do not expose the management/UI ports to untrusted networks until a vendor fix is available.
Event History
Frequently Asked Questions
What is CVE-2022-42948?
CVE-2022-42948 is a vulnerability in Fortra Cobalt Strike User Interface that allows remote code execution.
What is the affected software for CVE-2022-42948?
The affected software for CVE-2022-42948 is Fortra Cobalt Strike.
How does the vulnerability in CVE-2022-42948 occur?
The vulnerability in CVE-2022-42948 is rooted in Java Swing within the Fortra Cobalt Strike User Interface.
What is the severity of CVE-2022-42948?
The severity of CVE-2022-42948 is not specified.
Is there a fix for CVE-2022-42948?
Yes, a fix for CVE-2022-42948 is available in the latest update of Fortra Cobalt Strike (version 4.7.2).