CVE-2022-42948
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Description
CVE-2022-42948 is a critical remote code execution vulnerability in Cobalt Strike 4.7.1 caused by improper encoding of output (CWE-116). The flaw arises because the Cobalt Strike user interface, built on Java Swing, fails to properly escape HTML tags when displaying data, allowing an attacker to inject crafted HTML that triggers code execution within the operator's Cobalt Strike client. CVE-2022-42948 carries a CVSS score of 9.8 (CRITICAL) and is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active real-world exploitation. This vulnerability is particularly notable because it targets the red team tool itself, turning the attacker's own infrastructure against them.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| helpsystems | cobalt strike | 4.7.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/(Technical Description, Third Party Advisory)
- https://www.cobaltstrike.com/blog/(Vendor Advisory)
- https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42948(US Government Resource)
Weakness Type
CWE-116: Improper Encoding or Escaping of Output
In the context of CVE-2022-42948, the Cobalt Strike teamserver and client UI fail to properly encode or escape HTML content before rendering it in Java Swing components. When beacon data containing malicious HTML tags is displayed in the UI, Swing interprets the HTML rather than treating it as plain text, enabling an attacker to inject code that executes within the Java runtime of the operator's workstation.
Learn more: CWE-116 — Improper Encoding or Escaping of Output
Impact Analysis
CVE-2022-42948 is remotely exploitable without physical access, requires no authentication, and demands no user interaction beyond the normal operation of the Cobalt Strike interface. Rated CRITICAL with a CVSS score of 9.8, successful exploitation results in high impact to confidentiality, integrity, and availability — an attacker can achieve arbitrary code execution on the machine running the Cobalt Strike client, potentially gaining full access to the red team operator's workstation and all associated campaign data. The implications are especially severe because Cobalt Strike operators typically have elevated network access and credentials stored within their environment, meaning a compromise of the operator's machine could cascade into broader infrastructure compromise. With an EPSS score of 0.20 (95th percentile), there is a meaningful probability of exploitation, and organizations using Cobalt Strike should prioritize this patch to protect their red team operations.
Exploit Maturity
Active exploitation of CVE-2022-42948 has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023. Detailed technical write-ups explaining the exploitation technique are publicly available from The Sec Master and Red Packet Security, providing sufficient detail for reproduction. The vulnerability is particularly attractive to threat actors who seek to compromise offensive security teams or hijack legitimate Cobalt Strike deployments.
Remediation
- Update Cobalt Strike immediately to a version newer than 4.7.1 that addresses this HTML injection flaw. Check the Cobalt Strike blog for the latest security patches and release announcements from Fortra (formerly HelpSystems).
- Restrict network exposure of Cobalt Strike teamservers by ensuring they are only accessible from trusted operator networks. Deploy firewall rules that limit inbound and outbound connections to authorized IP ranges, preventing untrusted beacons from delivering malicious payloads to the UI.
- Implement strict input validation on all data displayed in the Cobalt Strike interface, including beacon metadata fields such as usernames, hostnames, and process names. If custom aggressor scripts are in use, audit them for any rendering of untrusted data in Swing UI components.
- Monitor Cobalt Strike teamserver logs for anomalous beacon registrations containing HTML or JavaScript-like content in metadata fields. Alert on beacons that submit unusual characters or encoded payloads in fields typically containing simple strings.
- Run Cobalt Strike client processes in sandboxed environments or virtual machines to limit the blast radius of any successful exploitation. Ensure that red team workstations follow the principle of least privilege and do not store credentials in plaintext.
Technical Details
CVE-2022-42948 stems from improper encoding or escaping of output (CWE-116) in the Cobalt Strike 4.7.1 user interface. Java Swing components have a well-known behavior of interpreting HTML content within JLabel and other text-rendering components when the string begins with an HTML tag. The vulnerability is triggered when beacon data containing crafted HTML — specifically tags that reference external resources or invoke Java functionality through Swing's HTML rendering engine — is displayed in the teamserver UI without prior sanitization. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation is network-based with low complexity, requires no authentication or user interaction, and achieves full compromise of the Cobalt Strike client's host system. An attacker could exploit this by modifying beacon payloads or registering rogue beacons with HTML-injected metadata fields, causing the malicious content to be rendered automatically when an operator views the beacon list or its details.
Frequently Asked Questions
What is CVE-2022-42948?
CVE-2022-42948 is a critical remote code execution vulnerability in Cobalt Strike 4.7.1 where the Java Swing-based user interface fails to properly escape HTML tags, allowing an attacker to inject malicious HTML that executes code on the operator's workstation.
How severe is CVE-2022-42948?
With a CVSS score of 9.8 (CRITICAL), this is a maximum-severity vulnerability. Exploitation requires no authentication and no user interaction, enabling fully remote code execution on the Cobalt Strike operator's machine.
Which versions of Cobalt Strike are affected?
Cobalt Strike version 4.7.1 is specifically identified as vulnerable. Users should update to the latest available version from Fortra.
Who is at risk from CVE-2022-42948?
Primarily red team operators and penetration testers who use Cobalt Strike. An adversary — or a target of a red team engagement — could exploit this flaw to reverse-attack the operator, gaining access to their workstation and campaign data.
Has CVE-2022-42948 been exploited in the wild?
Yes. CISA has confirmed active exploitation by adding CVE-2022-42948 to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.