CVE-2022-39197
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2022-39197 is a cross-site scripting (XSS) vulnerability in HelpSystems Cobalt Strike through version 4.7 that allows a remote attacker to execute HTML on the Cobalt Strike teamserver interface. To exploit this flaw, an attacker must inspect a Cobalt Strike beacon payload and modify the username field — or create a new payload with modified metadata — to contain malicious HTML that is rendered when an operator views the beacon in the UI. CVE-2022-39197 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 0.20 (95th percentile), this cross-site scripting vulnerability in Cobalt Strike represents a real risk to red team operators and organizations using this penetration testing platform.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| helpsystems | cobalt strike | < 4.7.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/(Mitigation, Vendor Advisory)
- https://www.cobaltstrike.com/blog/tag/release/(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-39197(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
In the context of CVE-2022-39197, the Cobalt Strike teamserver and client UI fail to properly neutralize HTML content embedded in beacon metadata fields such as the username. When a beacon with a crafted username field is displayed in the Java Swing-based interface, the HTML is interpreted and rendered rather than displayed as plain text, enabling an attacker to execute scripts or inject content within the operator's UI.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation
Impact Analysis
CVE-2022-39197 is remotely exploitable without physical access and requires no authentication, though it does require user interaction in the form of an operator viewing the malicious beacon data in the Cobalt Strike UI. With a CVSS score of 6.1 (MEDIUM) and a changed scope, the vulnerability can affect resources beyond the Cobalt Strike component itself — specifically the operator's workstation environment. The confidentiality and integrity impacts are low individually, but the practical risk is significant because successful exploitation could allow an attacker to escalate from simple HTML injection to code execution on the red team operator's machine, especially when combined with other vulnerabilities like CVE-2022-42948. The EPSS score of 0.20 (95th percentile) indicates a meaningful probability of exploitation, and this vulnerability is particularly dangerous because it enables adversaries to turn the tables on offensive security teams by weaponizing the very tools they use.
Exploit Maturity
Active exploitation of CVE-2022-39197 has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023. Fortra (formerly HelpSystems) released an out-of-band update to Cobalt Strike 4.7.1 to address this XSS flaw, indicating the urgency with which the vendor treated the issue. The vulnerability has attracted attention from both security researchers and threat actors, as it provides a vector for counter-attacking red team operators or hijacking Cobalt Strike infrastructure.
Remediation
- Update Cobalt Strike to version 4.7.1 or later as released by Fortra in the out-of-band security update, which addresses the HTML injection in beacon metadata display. If updating is not possible, discontinue use of the affected versions.
- Apply all subsequent Cobalt Strike patches by reviewing the Cobalt Strike release blog for additional security fixes. Note that CVE-2022-42948 was discovered in 4.7.1 as an incomplete fix for this same class of issue, so ensure you are running the fully patched version.
- Restrict beacon registration on teamservers by implementing authentication and network-level controls that prevent untrusted or rogue beacons from connecting. Use malleable C2 profiles with strong validation to reject beacons containing unexpected metadata content.
- Monitor beacon metadata fields (username, hostname, process name) for unusual content such as HTML tags, encoded characters, or excessive string lengths. Configure alerts for any beacon registrations that deviate from expected patterns.
- Operate Cobalt Strike clients within isolated environments such as dedicated virtual machines or containers to minimize the impact of any UI-level exploitation. Ensure red team workstations are hardened and do not have direct access to sensitive internal systems.
Technical Details
CVE-2022-39197 is a cross-site scripting vulnerability (CWE-79) in the Cobalt Strike teamserver's handling of beacon metadata display in Java Swing UI components. The attack requires an adversary to first inspect a Cobalt Strike beacon payload to extract the configuration details, then modify the username field within the beacon's metadata to contain crafted HTML. When this modified beacon checks in to the teamserver and an operator views the beacon list, the Java Swing component renders the HTML content rather than escaping it, because Swing's JLabel and similar components natively interpret strings beginning with HTML tags. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-based attack with low complexity and no privileges required, though user interaction is necessary since the operator must view the beacon data. The changed scope reflects that the injected content executes within the operator's broader desktop context, potentially impacting resources beyond Cobalt Strike itself.
Frequently Asked Questions
What is CVE-2022-39197?
CVE-2022-39197 is a cross-site scripting (XSS) vulnerability in HelpSystems Cobalt Strike through version 4.7 that allows attackers to execute malicious HTML within the Cobalt Strike teamserver UI by injecting crafted content into beacon metadata fields such as the username.
How severe is CVE-2022-39197?
The vulnerability has a CVSS score of 6.1 (MEDIUM). While the direct impact is low confidentiality and integrity compromise, the practical risk is elevated because it targets red team operators and can potentially be chained with other vulnerabilities for full code execution.
Which versions of Cobalt Strike are affected?
HelpSystems Cobalt Strike through version 4.7 is affected. The initial fix was released in version 4.7.1, though that version introduced a related vulnerability (CVE-2022-42948) that required further patching.
How is CVE-2022-39197 exploited?
An attacker inspects a Cobalt Strike beacon payload to extract configuration data, then modifies the username field to contain malicious HTML. When the modified beacon connects to the teamserver and an operator views it, the HTML is rendered in the Swing UI.
What is the relationship between CVE-2022-39197 and CVE-2022-42948?
CVE-2022-39197 is the original XSS vulnerability in Cobalt Strike through 4.7. The patch in version 4.7.1 was incomplete, leading to CVE-2022-42948, which addresses a similar but distinct HTML injection issue with more severe impact (CRITICAL vs. MEDIUM).
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.