Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

概要

参考情報

• thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike · Technical Description
• cobaltstrike.com/blog · Vendor Advisory
• redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948 · Third Party Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2022-42948

cobalt strike のその他の脆弱性

• CVE-2022-39197中 6.1悪用確認済み（CISA KEV）An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTM…
• CVE-2022-23317高 7.5CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant informatio…
• CVE-2021-36798高 7.5A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers t…