PT-2021-21365 · Helpsystems · Cobalt Strike

Gal Kristal · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-36798

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HelpSystems Cobalt Strike versions 4.2 through 4.3

Description A Denial-of-Service (DoS) issue was discovered in Team Server. It allows remote attackers to crash the C2 server thread and block beacons' communication with it.

Recommendations For versions 4.2 and 4.3, consider temporarily restricting access to the Team Server to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2021-36798

Affected Products

Cobalt Strike

References · 10

• 🔥 https://github.com/JamVayne/CobaltStrikeDos · Exploit
• 🔥 https://github.com/M-Kings/CVE-2021-36798 · Exploit
• 🔥 https://labs.sentinelone.com/hotcobalt-new-cobalt-strike-dos-vulnerability-that-lets-you-halt-operations · Exploit
• 🔥❌ https://github.com/hariomenkel/CobaltSploit · Exploit, Deleted
• 🔥❌ https://github.com/NexusFuzzy/CobaltSploit · Exploit, Deleted
• https://cobaltstrike.com/releasenotes.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36798 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36798 · Vendor Advisory
• https://t.me/cvenotify/19513 · Telegram Post
• https://t.me/cibsecurity/27012 · Telegram Post