Experts warn of critical JetBrains TeamCity On
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-42793 | Authentication bypass in JetBrains TeamCity enables unauthenticated RCE JetBrains TeamCity Server, a widely used CI/CD build server, contains an authentication bypass vulnerability (CWE-288) that lets a remote, unauthenticated attacker gain administrative access without valid credentials. By sending crafted requests to the TeamCity server over the network, the attacker bypasses authentication and can then execute arbitrary code on the server via administrative and build features, achieving full remote code execution. An attacker gains control of the build server and, with it, access to source code, build artifacts, stored secrets and credentials, and a foothold for lateral movement or ransomware deployment. Any organization running an affected TeamCity Server is affected, especially instances reachable from the internet. Exploitation is confirmed in the wild: CISA added the flaw to its KEV catalog on 2023-10-04 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Upgrade TeamCity Server to 2023.05.4 or later per JetBrains' instructions, or apply vendor mitigations or discontinue use if patching is not possible (per the CISA KEV required action). Also take unpatched instances off the public internet, and hunt for signs of compromise such as unauthorized administrator accounts, unexpected changes in audit logs and build configurations, and stored secrets or tokens that may have been stolen, given known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largeTens of thousands of TeamCity Server deployments, of which several thousand are internet-exposed | |
| CVE-2024-23917 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible NVD description · AI analysis pending | 9.8 | 54% |
| — |
Full article328 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 07, 2024
A new vulnerability in JetBrains TeamCity On-Premises can be exploited by threat actors to take over vulnerable instances.
JetBrains addressed a critical security vulnerability, tracked as CVE-2024-23917 (CVSS score 9.8) in its TeamCity On-Premises continuous integration and continuous deployment (CI/CD) software.
An attacker can trigger the vulnerability to take over vulnerable installs.
“The vulnerability may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server.” reads the advisory. “The vulnerability affects all TeamCity On-Premises versions from 2017.1 through 2023.11.2.”
JetBrains has fixed the flaw with the release of version 2023.11.3.
Administrators who are not able to update their instances to version 2023.11.3 can download a security patch plugin to patch their environment. The security patch plugin can be installed on TeamCity versions 2017.1 through 2023.11.2. It will patch the vulnerability described above.
“The security patch plugin will only address the vulnerability described above. We always recommend upgrading your server to the latest version to benefit from many other security updates.” concludes the advisory. “If your server is publicly accessible over the internet and you are unable to take one of the above mitigation steps immediately, we recommend temporarily making it inaccessible until mitigation actions have been completed.”
The company is not aware of attacks in the wild exploiting this vulnerability.
In December, experts warn that the Russia-linked APT29 group has been observed targeting JetBrains TeamCity servers to gain initial access to the targets’ networks.
The attackers were observed exploiting an authentication bypass issue, tracked as CVE-2023-42793, affecting the on-premises version of TeamCity. An attacker can exploit the flaw to steal source code and stored service secrets and private keys of the target organization. By injecting malicious code, an attacker can also compromise the integrity of software releases and impact all downstream users.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, TeamCity)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/158790/hacking/jetbrains-teamcity-on-premises-bug.html