CVE-2022-39197

What it actually does

This is a cross-site scripting vulnerability in HelpSystems/Fortra Cobalt Strike Team Server versions through 4.7. An unauthenticated remote attacker who can obtain or inspect a Cobalt Strike payload can modify the payload username/user metadata field to include malformed HTML or script content. When that crafted metadata is processed and viewed by a Cobalt Strike operator or client, attacker-controlled HTML/JavaScript can execute in the Cobalt Strike user interface context. The flaw has network attack vector, low attack complexity, no required attacker authentication, and requires user interaction by an operator viewing the malicious payload/session metadata. Impact is primarily confidentiality and integrity: attacker-controlled script can alter displayed content, phish operators, potentially access UI-accessible data, or perform actions available within the affected Cobalt Strike interface context.

Why it matters to the business

Organizations running affected Cobalt Strike infrastructure risk compromise or manipulation of tooling used for security testing, incident response, or adversary simulation. Successful exploitation can undermine trust in assessment infrastructure, expose operational details, mislead operators, and create a pathway for attackers to interfere with engagements or defensive investigations. This vulnerability is listed in CISA KEV with active exploitation observed in the wild and a remediation due date of 2023-04-20, so unpatched instances should be treated as overdue and high priority despite the medium CVSS score. The EPSS score of approximately 46% indicates materially elevated exploitation likelihood compared with most vulnerabilities.

How an attack unfolds

An attacker first obtains or inspects a Cobalt Strike payload to understand the metadata required to communicate with a target Team Server. They then modify the username/user metadata field in the payload, or create a new payload with equivalent extracted configuration, embedding HTML or JavaScript payloads such as script tags, event-handler attributes, or encoded markup. The crafted payload connects or is presented in a way that causes the Team Server and Cobalt Strike client interface to process the malformed username. When an operator views the affected beacon/session/payload metadata, the injected content is rendered rather than safely encoded, causing attacker-controlled code or HTML to execute in the operator-facing interface context. In real-world abuse, this can be used to manipulate what operators see, capture sensitive UI data available to the browser/component context, redirect or phish operators, or chain with other weaknesses in the operator workstation or Cobalt Strike deployment.

How to fix it

Upgrade Cobalt Strike to a vendor-supported version that contains the fix for CVE-2022-39197; versions through 4.7 are affected. If exact fixed package versions are managed internally, standardize on the latest supported Fortra Cobalt Strike release rather than any 4.7-or-earlier build. Remove or isolate legacy Team Servers that cannot be upgraded. Restrict network access to Team Servers to authorized operator networks only, enforce strong authentication and segmentation, and avoid exposing Team Server management or listener infrastructure broadly. Treat payloads or beacons with unexpected, malformed, or HTML-like usernames as malicious. Where immediate upgrade is not possible, reduce risk by limiting who can connect to the Team Server, monitoring beacon metadata, and preventing operators from interacting with suspicious sessions until the platform is remediated.

How to confirm the fix worked

Confirm the installed Cobalt Strike version on every Team Server and operator client and verify no deployment is running version 4.7 or earlier. Review vendor release notes or package metadata to ensure the deployed build includes the XSS fix. Validate that Team Server access is restricted to expected networks and that unauthenticated or unnecessary exposure is removed. In a controlled non-production test environment only, submit benign encoded HTML in a username/user metadata field and confirm it is displayed as inert text rather than rendered markup. Review logs and UI/session records for malformed usernames containing HTML tags, JavaScript schemes, encoded angle brackets, or event-handler attributes. Confirm SIEM detections are alerting on suspicious Cobalt Strike metadata patterns.

Typical attack path

1. Identify an exposed or reachable Cobalt Strike Team Server or obtain a Cobalt Strike payload associated with one.
2. Inspect the payload configuration to extract connection details and required metadata format.
3. Modify the username/user metadata field to contain malicious HTML or JavaScript, often using encoded XSS syntax to evade simple filtering.
4. Send or run the crafted payload so the malformed metadata is submitted to the Team Server.
5. Wait for a Cobalt Strike operator to view the affected beacon/session/payload details in the client interface.
6. Execute attacker-controlled HTML/JavaScript in the Cobalt Strike UI context and use it to manipulate the interface, collect accessible data, or support follow-on compromise.

How to detect it

To determine whether exploitation already occurred, review Cobalt Strike Team Server logs, operator client logs, reverse proxy or load balancer logs in front of Team Servers, EDR telemetry from Team Server and operator workstations, and any retained beacon/session metadata. Focus on malformed username/user fields containing raw or URL-encoded HTML, JavaScript, SVG, iframe, image error handlers, or other XSS constructs. Look for suspicious sessions where the username contains markup, encoded angle brackets, JavaScript URI schemes, or event-handler attributes. Correlate those events with operator logins, UI activity, new outbound network connections from operator workstations, unexpected file downloads, clipboard access, credential prompts, or browser/component crashes. If threat-intelligence context is available, compare Team Server connection sources and payload metadata against known malicious Cobalt Strike infrastructure, but do not rely on static infrastructure indicators alone because payload metadata can be attacker-controlled. Since this vulnerability has been exploited in the wild and is listed in KEV, absence of a crash or obvious error should not be considered proof of non-exploitation; prioritize metadata review and endpoint telemetry around the time suspicious beacon/session entries were viewed.

• <script
• </script>
• %3Cscript
• %3C%2Fscript%3E
• javascript:
• %6A%61%76%61%73%63%72%69%70%74%3A
• onerror=
• onload=
• onclick=
• onmouseover=
• <img
• %3Cimg
• <svg
• %3Csvg
• <iframe
• %3Ciframe
• document.cookie
• window.location
• eval(
• alert(
• prompt(
• confirm(
• String.fromCharCode
• &#x3c;script
• &lt;script
• username=<script
• username=%3Cscript
• user=<script
• user=%3Cscript

What your security team should do

• Immediately inventory all Cobalt Strike Team Servers and operator clients; prioritize any version through 4.7 for upgrade or decommissioning.
• Because this vulnerability is in CISA KEV and the remediation deadline has passed, treat remaining affected instances as urgent exceptions requiring documented risk acceptance or immediate remediation.
• Restrict Team Server and management access to approved operator networks using firewall rules, VPN, and segmentation; remove unnecessary internet exposure.
• Hunt historical logs and Cobalt Strike artifacts for HTML/script-like content in username, user, beacon, or session metadata fields.
• Quarantine and investigate any beacon/session with malformed or encoded markup in identity fields before an operator interacts with it.
• Review operator workstations used with Cobalt Strike for signs of browser/UI compromise, credential theft, suspicious downloads, or unexpected outbound connections around the time suspicious payloads were viewed.
• Add SIEM rules for common XSS payload strings in Cobalt Strike logs, reverse proxy logs, EDR telemetry, and Team Server-related application logs.
• Ensure only trusted payloads generated by patched infrastructure are used during assessments and rotate any secrets or credentials exposed through affected operator workflows.