CVE-2021-36798 Denial of service in n/a

High 7.5 Published 9 Aug 2021 Updated 4 Aug 2024

Remote attackers can crash the Cobalt Strike Team Server thread, blocking beacon communications and causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-36798?

CVE-2021-36798 is a high-severity denial of service vulnerability in n/a, published on 9 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 server thread and block beacons' communication with it.

Weakness: CWE-770

Which versions are affected by CVE-2021-36798?

It affects 1 product.

Products include Helpsystems Cobalt Strike.

How do I fix CVE-2021-36798?

No fix has been published for CVE-2021-36798 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-36798 being exploited?

There is no known exploitation of CVE-2021-36798 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Sources

Also known as GHSA-6vhg-vrw5-pm3f.