CVE-2022-39197 PoC — HelpSystems Cobalt Strike 跨站脚本漏洞

Source

https://github.com/burpheart/CVE-2022-39197-patch

Associated Vulnerability

Title: HelpSystems Cobalt Strike 跨站脚本漏洞 (CVE-2022-39197)
Description:An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

Description

CVE-2022-39197 漏洞补丁. CVE-2022-39197 Vulnerability Patch.

Readme

# CVE-2022-39197 patch

### CVE-2022-39197 Cobalt Strike XSS 漏洞的一个临时补丁

通过 hook javax.swing.plaf.basic.BasicHTML的isHTMLString方法来禁用swing的html支持

PS: 部分依赖html的页面无法正常渲染(例如 关于页面)

### 使用方法
将 patch.jar 放入cobaltstrike启动目录下

在cobaltstrike启动参数中加入javaagent 启用补丁
```
-javaagent:patch.jar
```

启动cobaltstrike 输出Successfully Patched. 即为禁用成功
```
====== CVE-2022-39197 patch @burpheart ======
Successfully Patched.
```


------------------
CVE-2022-39197 Cobalt Strike XSS vulnerability patch

Disable html support for swing by hooking the isHTMLString method of javax.swing.plaf.basic.

PS: Some html-dependent pages do not render properly ( Such as About page etc.)
Add javaagent to the cobaltstrike startup parameters to enable patching
```
-javaagent:patch.jar
```

Start cobaltstrike and output Successfully Patched.
```
====== CVE-2022-39197 patch @burpheart ======
Successfully Patched.
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →