Actively exploited in the wild
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Fortra - Cobalt Strike · Listed in the CISA KEV since 2023-03-30. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-39197
MediumCVSS 6.1KEVSummary
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).
Risk Assessment
An attacker could execute arbitrary HTML/JavaScript in the context of the Cobalt Strike teamserver, potentially leading to session theft, server takeover, or further attacks on the infrastructure.
Recommendation
Update HelpSystems Cobalt Strike to a version later than 4.7. Restrict access to the teamserver to trusted networks and verify payloads before use.
Other vulnerabilities in Cobalt Strike
Original NVD description (English source)
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).