CVE-2021-36798: Cobalt Strike Team Server DoS Vulnerability

CVE-2021-36798 Overview

CVE-2021-36798 is a Denial-of-Service (DoS) vulnerability in the Team Server component of HelpSystems Cobalt Strike versions 4.2 and 4.3. Remote attackers can crash the command-and-control (C2) server thread, blocking beacon communication with the server. The flaw is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling) and was analyzed publicly by SentinelLabs under the name "Hotcobalt." Because Cobalt Strike Team Server orchestrates beacon traffic during red-team and adversary operations, a crash disrupts every active session relying on that instance. The vulnerability is network-reachable, requires no authentication, and no user interaction.

Critical Impact

Unauthenticated remote attackers can crash the Cobalt Strike Team Server, severing communication with all connected beacons and halting C2 operations.

Affected Products

• HelpSystems Cobalt Strike 4.2
• HelpSystems Cobalt Strike 4.3
• Team Server component handling beacon staging and tasking

Discovery Timeline

• 2021-08-09 - CVE-2021-36798 published to the National Vulnerability Database
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-36798

Vulnerability Analysis

The vulnerability resides in how the Cobalt Strike Team Server parses and stores data received from beacon clients during check-in and task retrieval. The server trusts client-supplied size fields and screenshot or file payload metadata without sufficient validation. A crafted client can submit oversized or malformed payloads that force the server to allocate excessive memory, leading to an unhandled exception and crashing the listener thread. Once the thread terminates, registered beacons can no longer communicate, and operators lose control of in-flight operations until the server is restarted.

Root Cause

The root cause is missing resource allocation limits ([CWE-770]) in the Team Server's payload handling routines. The server processes attacker-controlled length fields without enforcing upper bounds, allowing memory exhaustion or out-of-memory conditions inside the Java virtual machine hosting the Team Server.

Attack Vector

Exploitation requires network access to the Team Server's beacon listener, which is typically exposed on the internet to support real engagements. The attacker registers a fake beacon by replicating the staging protocol, then submits malformed tasking responses such as oversized screenshots. No authentication or operator interaction is required. Technical details, including the staging protocol reverse-engineering and crash conditions, are documented in the SentinelLabs Hotcobalt analysis.

Detection Methods for CVE-2021-36798

Indicators of Compromise

• Unexpected termination or restart of the Cobalt Strike Team Server process on hosts performing offensive operations
• Sudden loss of check-ins from multiple beacons followed by JVM out-of-memory errors in Team Server logs
• Inbound HTTP or HTTPS requests to beacon staging URIs from unknown sources with abnormally large POST bodies

Detection Strategies

• Monitor Team Server JVM logs for OutOfMemoryError exceptions and thread death events tied to beacon handlers
• Inspect network flows to listener ports for anomalously large uploads that deviate from normal beacon screenshot or file sizes
• Correlate beacon disconnect spikes with inbound traffic from non-allowlisted IP ranges

Monitoring Recommendations

• Forward Team Server stdout, stderr, and JVM crash logs to a centralized logging platform for alerting on repeated crashes
• Track listener uptime as a service-level metric so operators are notified within seconds of a thread failure
• Apply network detection rules that flag traffic resembling Cobalt Strike staging requests from unauthorized sources

How to Mitigate CVE-2021-36798

Immediate Actions Required

• Upgrade Cobalt Strike Team Server to version 4.4 or later, which addresses the unbounded allocation in beacon payload handling
• Restrict inbound access to Team Server listener ports using redirectors, allowlists, or firewall rules so only intended targets can reach the server
• Rotate any in-use beacon configurations and watermarks if a crash is observed during an active engagement

Patch Information

HelpSystems addressed the issue in Cobalt Strike 4.4. Operators should review the Cobalt Strike Release Notes and update Team Server binaries to the fixed release. No supported workaround restores resource limits in versions 4.2 and 4.3 without applying the vendor update.

Workarounds

• Place the Team Server behind hardened redirectors that filter unexpected beacon staging traffic and drop oversized payloads
• Limit listener exposure to specific source IP ranges associated with the engagement scope
• Run Team Server with constrained JVM heap settings and automated process supervision to recover quickly if the thread crashes

# Configuration example: restrict Team Server listener exposure with iptables
iptables -A INPUT -p tcp --dport 50050 -s <operator_ip>/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 50050 -j DROP

# Verify Cobalt Strike version after upgrade
./teamserver --version