CVE-2021-43200
📋 TL;DR
This vulnerability in JetBrains TeamCity allows attackers to bypass permission checks in the Agent Push functionality, potentially enabling unauthorized code execution or system compromise. It affects all TeamCity installations before version 2021.1.2 that have the Agent Push feature enabled.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to deploy malicious agents, steal credentials, or pivot to other systems in the CI/CD pipeline.
Likely Case
Unauthorized deployment of malicious build agents, leading to code injection, credential theft, or disruption of CI/CD processes.
If Mitigated
Limited impact with proper network segmentation and strict access controls, potentially only allowing unauthorized agent registration without code execution.
🎯 Exploit Status
Exploitation requires some level of access but bypasses permission checks, making it relatively straightforward for authenticated attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.1.2 or later
Vendor Advisory: https://blog.jetbrains.com/blog/2021/11/08/jetbrains-security-bulletin-q3-2021/
Restart Required: Yes
Instructions:
1. Backup TeamCity configuration and data. 2. Download TeamCity 2021.1.2 or later from JetBrains website. 3. Stop TeamCity server. 4. Install the new version following JetBrains upgrade guide. 5. Restart TeamCity server. 6. Verify functionality.
🔧 Temporary Workarounds
Disable Agent Push
allTemporarily disable the vulnerable Agent Push functionality to prevent exploitation.
Navigate to Administration > Global Settings > Agent Push and disable the feature
Restrict Network Access
allLimit TeamCity server access to trusted IP addresses only.
Configure firewall rules to restrict TeamCity ports (default 8111) to authorized networks
🧯 If You Can't Patch
- Implement strict network segmentation to isolate TeamCity from critical systems
- Enforce multi-factor authentication and least privilege access controls for all TeamCity users
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration > Global Settings. If version is below 2021.1.2, the system is vulnerable.Check Version:
Check TeamCity web interface at Administration > Global Settings or examine teamcity-server.log for version informationVerify Fix Applied:
Verify TeamCity version is 2021.1.2 or higher in Administration > Global Settings and test Agent Push functionality with proper permissions.📡 Detection & Monitoring
Log Indicators:
- Unauthorized Agent Push attempts in teamcity-server.log
- Unexpected agent registrations or deployments
Network Indicators:
- Unusual network traffic to/from TeamCity agent ports
- Suspicious agent communication patterns
SIEM Query:
source="teamcity-server.log" AND ("Agent Push" OR "unauthorized" OR "permission denied")