CVE-2022-42948

published 2023-03-24

CVE-2022-42948: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely…

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

KEV ITW

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
helpsystems	cobalt_strike	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2022-42948 involves injecting crafted HTML into Cobalt Strike UI Swing components to achieve RCE; monitor for unexpected HTML tags in Cobalt Strike beacon/operator input fields ↗
• → The vulnerability is rooted in Java Swing's HTML rendering; detect exploitation attempts by monitoring for HTML injection patterns (e.g., <script>, <img>, <object> tags) in data rendered by Cobalt Strike UI components ↗

• · Vulnerability is specific to Cobalt Strike version 4.7.1 and earlier; version 4.7.2 (out-of-band update) contains the fix — confirm version before triaging alerts ↗
• · Vendor patch reference is the out-of-band Cobalt Strike 4.7.2 update; detections should be validated against patched instances to reduce false positives ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

cisa 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-116 CWE-79