TeamCity Users Urged to Patch Critical Vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-27198 +1 in the same advisory: …27199 | Authentication Bypass in JetBrains TeamCity CI/CD Server CVE-2024-27198 is an authentication bypass (CWE-288) in JetBrains TeamCity, JetBrains' self-hosted on-premises continuous integration/continuous delivery (CI/CD) server, that allows an unauthenticated attacker to circumvent login and perform administrative actions. It is triggered by sending specially crafted requests to the TeamCity web interface that dodge the authentication check, after which the attacker gains full administrator access. With admin access, an attacker can create administrative accounts, alter build configurations, plant code that runs on the server and its build agents, and reach source code, credentials, and secrets stored in the CI/CD environment, which ransomware operators have already used as an entry point. Any TeamCity deployment an attacker can reach over the network is affected, with internet-facing instances at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2024-03-07 with known ransomware use, and EPSS estimates a 99.9% probability of exploitation within 30 days. Do: Upgrade immediately to the patched TeamCity release per JetBrains' advisory (2023.11.4 or later fixes this vulnerability), or apply vendor mitigations or discontinue use per CISA guidance if patching is not possible. Audit instances for unexpected administrator accounts, modified build configurations, and other signs of compromise, since ransomware operators are known to be actively exploiting this bug. Restrict TeamCity's network exposure to trusted users and networks until the update is applied. | 9.8 group max | 100% | KEV ransomware |
| largetens of thousands of internet-exposed TeamCity servers (roughly 20,000–30,000 per public scans at disclosure) |
Full article302 words · extracted from infosecurity-magazine.com · click to collapse
Software developer JetBrains has warned users of its popular TeamCity CI/CD tool that they should prioritize patching of two new vulnerabilities or risk compromise.
Discovered by Rapid7 last month, the bugs are listed as CVE-2024-27198 and CVE-2024-27199. The security vendor has now released exploit details, which makes patching more urgent.
The former is an authentication bypass vulnerability in the web component of TeamCity that arises from an alternative path issue (CWE-288) and has a CVSS base score of 9.8. The latter is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue (CWE-22) and has a CVSS base score of 7.3.
“Both vulnerabilities are authentication bypass vulnerabilities, the most severe of which, CVE-2024-27198, allows for a complete compromise of a vulnerable TeamCity server by a remote unauthenticated attacker, including unauthenticated remote code execution (RCE),” said Rapid7 in a blog post.
“The second vulnerability, CVE-2024-27199, allows for a limited amount of information disclosure and a limited amount of system modification, including the ability for an unauthenticated attacker to replace the HTTPS certificate in a vulnerable TeamCity server with a certificate of the attacker’s choosing.”
Read more on TeamCity vulnerabilities: Patched Critical Flaw Exposed JetBrains TeamCity Servers
Rapid7 warned that compromising TeamCity servers would enable a threat actor to gain full remote control of projects, builds, agents and artifacts, putting them in a strong position to launch dangerous supply chain attacks.
JetBrains yesterday released a new version of the software, 2023.11.4, to fix the two vulnerabilities. It also published a security patch plugin so that customers who are unable to upgrade can still patch their environment.
“All versions of TeamCity On-Premises are affected by these vulnerabilities. Customers of TeamCity Cloud have already had their servers patched, and we have verified that they weren’t attacked,” the vendor said.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/teamcity-urged-patch-critical/