CVE-2022-42948

What it actually does

Cobalt Strike 4.7.1 does not correctly escape HTML before rendering untrusted content in Java Swing UI components. A crafted value containing HTML can be interpreted by the client UI rather than displayed as inert text, allowing an attacker to trigger code execution in the Cobalt Strike client context. Successful exploitation can execute commands with the privileges of the user running the Cobalt Strike UI, potentially compromising the operator workstation and any credentials, files, or network access available to that user.

Why it matters to the business

Organizations using vulnerable Cobalt Strike versions risk compromise of security-testing infrastructure and operator workstations. Because Cobalt Strike systems often have privileged access, credentials, payloads, and connectivity into sensitive networks, exploitation can lead to broader operational compromise, loss of assessment integrity, credential theft, unauthorized lateral movement, and disruption of security operations. This vulnerability is listed in CISA KEV with a remediation due date of 2023-04-20 and has been observed exploited in the wild, so vulnerable instances should be treated as high-priority even though the EPSS score is moderate.

How an attack unfolds

An attacker supplies crafted HTML content through a field or object that will be displayed in the Cobalt Strike Swing-based user interface. When a vulnerable Cobalt Strike 4.7.1 client renders that content, the UI fails to sanitize or escape the HTML. The malicious markup is interpreted by the Java Swing renderer and can be used to trigger code execution in the client process. The resulting code runs on the workstation where the Cobalt Strike client is open, under that user’s privileges. From there, the attacker may spawn child processes, write files, steal local credentials or Cobalt Strike artifacts, access team-server material, or pivot using the operator workstation’s network reachability. Public reporting and KEV status indicate real-world exploitation activity against this issue.

How to fix it

Upgrade Cobalt Strike to a vendor-supported version that contains the fix for this vulnerability; do not continue operating Cobalt Strike 4.7.1. If immediate upgrade is not possible, restrict access to team servers and Cobalt Strike clients, isolate operator workstations, avoid interacting with untrusted or unknown Cobalt Strike artifacts, and limit outbound network access from operator workstations. Treat any vulnerable Cobalt Strike client that has rendered untrusted content as potentially compromised. Because this issue is in CISA KEV and the remediation deadline has passed, remediation should be handled as an urgent patch-and-verify activity.

How to confirm the fix worked

Confirm all Cobalt Strike clients and team-server components are no longer version 4.7.1 and are running a vendor-supported fixed release. Validate by checking the Cobalt Strike client About/version information, deployed package inventory, software asset management records, and hashes or timestamps of installed client JARs. On operator workstations, verify that the Java process used for Cobalt Strike no longer spawns unexpected shells, script interpreters, download tools, or unsigned binaries during normal use. Reproduce only in an isolated lab if necessary by confirming that crafted HTML is rendered as escaped text or otherwise safely handled after upgrade.

Typical attack path

1. Identify an organization or operator using Cobalt Strike 4.7.1 or another vulnerable build.
2. Deliver crafted HTML content through a Cobalt Strike-controlled data path that is rendered in the Swing UI.
3. Wait for the vulnerable Cobalt Strike client to display the malicious content.
4. Abuse improper HTML escaping in the Swing component to execute code inside the Java client process.
5. Run commands or payloads on the operator workstation with the privileges of the Cobalt Strike UI user.
6. Collect credentials, Cobalt Strike artifacts, local files, or network access tokens, then pivot or maintain persistence as appropriate.

How to detect it

To determine whether exploitation already occurred, focus on the workstations used to run the Cobalt Strike client and any systems that stored or launched the vulnerable client JAR. Review EDR and Sysmon process creation logs for Java or Cobalt Strike client processes spawning command shells, PowerShell, script interpreters, curl/wget, certutil, rundll32, regsvr32, mshta, or other living-off-the-land utilities. Review DNS, proxy, firewall, and netflow logs for unusual outbound connections initiated by java.exe, javaw.exe, or the Cobalt Strike client around times when the UI was active. Search Cobalt Strike client/team-server logs and captured artifacts for suspicious HTML markup in fields that should normally be plain text. Examine user profile directories, temporary directories, startup folders, scheduled tasks, LaunchAgents, cron jobs, and recent file writes for payloads created by the Java client process. Investigate any crash reports, Java exceptions, or unexpected UI-rendering errors correlated with suspicious HTML tags. Because the vulnerability executes in the operator client context, absence of server-side indicators does not rule out compromise; endpoint telemetry from client machines is the highest-value source.

• Cobalt Strike 4.7.1
• cobaltstrike-client.jar
• java -jar cobaltstrike-client.jar
• javaw.exe
• java.exe
• <html>
• </html>
• <object
• <embed
• <iframe
• <img
• <script
• cmd.exe /c
• powershell.exe
• pwsh.exe
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe
• curl.exe
• wget.exe
• /bin/sh -c
• /bin/bash -c

What your security team should do

• Immediately inventory all Cobalt Strike deployments and operator workstations for version 4.7.1 or unsupported builds.
• Upgrade vulnerable Cobalt Strike installations to a vendor-supported fixed release and retire old client packages from shared folders, jump boxes, and analyst workstations.
• Prioritize investigation of any vulnerable Cobalt Strike client used after public disclosure or after the CISA KEV due date of 2023-04-20.
• Hunt EDR, proxy, DNS, and host logs for Java/Cobalt Strike client processes spawning shells, script interpreters, or making unusual outbound connections.
• Rotate credentials and API tokens accessible from potentially exposed Cobalt Strike operator workstations.
• Restrict Cobalt Strike client and team-server access to hardened, monitored administrative workstations with least-privilege accounts.
• Block or alert on unexpected outbound internet access from Cobalt Strike operator workstations, especially from Java processes.
• Preserve Cobalt Strike client logs, workstation forensic artifacts, and EDR telemetry before reimaging or cleanup if exploitation is suspected.