PT-2022-24798 · Helpsystems · Cobalt Strike

Beichendream · Published 2022-09-22 · Updated 2025-09-23 · CVE-2022-39197

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HelpSystems Cobalt Strike versions through 4.7

Description A Cross Site Scripting (XSS) issue was found that allows a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit this issue, an attacker must first inspect a Cobalt Strike payload, then modify the username field in the payload to be malformed.

Recommendations For versions through 4.7, as a temporary workaround, consider restricting access to the teamserver to minimize the risk of exploitation. Avoid using the username field in the affected payload until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-39197

Affected Products

Cobalt Strike

References · 33

• 🔥 https://github.com/its-arun/CVE-2022-39197 · Exploit
• 🔥 https://github.com/burpheart/CVE-2022-39197-patch · Exploit
• 🔥 https://github.com/burpheart/cve-2022-39197 · Exploit
• 🔥 https://github.com/xzajyjs/CVE-2022-39197-POC · Exploit
• 🔥 https://github.com/xiao-zhu-zhu/pig_CS4.4 · Exploit
• 🔥 https://github.com/yqcs/CSPOC · Exploit
• 🔥 https://github.com/lovechoudoufu/about_cobaltstrike4.5_cdf · Exploit
• 🔥 https://github.com/TheCryingGame/CVE-2022-39197-RCE · Exploit
• 🔥 https://github.com/hluwa/cobaltstrike_swing_xss2rce · Exploit
• 🔥 https://github.com/4nth0ny1130/CVE-2022-39197-fix_patch · Exploit
• 🔥 https://github.com/safe3s/CVE-2022-39197 · Exploit
• 🔥 https://github.com/lovechoudoufu/cobaltstrike4.5_cdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39197 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39197 · Vendor Advisory
• https://cobaltstrike.com/blog/tag/release · Vendor Advisory