CVE-2021-43196
📋 TL;DR
This vulnerability in JetBrains TeamCity allows attackers to access sensitive information through the Docker Registry connection dialog. It affects TeamCity instances before version 2021.1. The information disclosure could expose credentials or configuration details.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to Docker registry credentials, allowing them to push/pull malicious images, compromise container environments, or access private repositories.
Likely Case
Unauthorized access to Docker registry connection details, potentially exposing credentials or configuration information.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the TeamCity interface.
🎯 Exploit Status
Exploitation requires access to the TeamCity web interface, but specific authentication requirements are not detailed in available references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.1 or later
Vendor Advisory: https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2021.1 or later from official JetBrains website. 3. Follow upgrade instructions for your platform. 4. Restart TeamCity services.
🔧 Temporary Workarounds
Restrict Docker Registry Dialog Access
allLimit access to the Docker Registry connection dialog through network controls or authentication.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate TeamCity from untrusted networks.
- Enforce strong authentication and limit user access to Docker Registry configuration features.
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Global Settings. If version is below 2021.1, the system is vulnerable.Check Version:
Check TeamCity web interface at Administration → Global Settings or review server logs for version information.Verify Fix Applied:
Verify TeamCity version is 2021.1 or higher in Administration → Global Settings.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Docker Registry configuration endpoints
- Failed authentication attempts followed by Docker Registry access
Network Indicators:
- Unexpected requests to /app/rest/deploy/dockerRegistry endpoints
- Traffic patterns suggesting information gathering from Docker configuration
SIEM Query:
source="teamcity.log" AND ("dockerRegistry" OR "Docker Registry") AND (status=200 OR status=403)