Tuesday, May 13, 2025
HomeCyber AttackCritical RCE Flaw Found in Popular Post-Exploitation Cobalt Strike Toolkit

Critical RCE Flaw Found in Popular Post-Exploitation Cobalt Strike Toolkit

Published on

SIEM as a Service

Follow Us on Google News

Recently, a brand-new out-of-band security update (Cobalt Strike 4.7.2) has been released by HelpSystems to fix an RCE vulnerability in the post-exploitation Cobalt Strike toolkit.

The RCE vulnerability has been identified and reported by the security experts from the X-Force Red Adversary Simulation Team, Rio Sherri (0x09AL) and Ruben Boonen (FuzzySec).

They also shared all the key findings with HelpSystems to help them in mitigating this critical RCE vulnerability.

- Advertisement - Google News

RCE Vulnerability

Cobalt Strike version 4.7.1 is affected by this vulnerability, which has been identified as CVE-2022-42948. During the September 20, 2022 patching cycle, an incomplete patch was released that resulted in this vulnerability. With this patch, the XSS vulnerability (CVE-2022-39197) has been fixed.

In order to exploit this XSS vulnerability, certain client-side UI input fields would need to be manipulated. While it is important to note that this manipulation can be accomplished with the help of the following form factors:-

  • Simulation of a Cobalt Strike implant check-in.
  • Affixing a Cobalt Strike implant running on a host.

In Cobalt Strike, the Java Swing framework, the toolkit that was used for the design of Cobalt Strike, could be used in certain cases in order to trigger the RCE.

A number of Java Swing components interpret the text automatically that starts with an HTML tag (“<html>”) as HTML content, and here an object tag can be used in this situation in order to exploit this vulnerability.

Here below we have mentioned a video in which you can see the flaw in action:-

Depending on the web server that is used, the Cobalt Strike client can actually load a malicious payload from the webserver and execute it. However, this behavior could be mitigated by disabling the auto-parsing of HTML tags.

As a result of this flaw, attackers could exploit it in order to load malicious payloads hosted on remote servers using an HTML <object> tag. Then in the user interface of the Cobalt strike, it is injected into the note field or the graphical file explorer menu.

This demonstrates how authentic tools like Cobalt Strike can be weaponized by threat actors for the purpose of executing a number of cyberattacks.

Also Read: Download Secure Web Filtering – Free E-book

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...