CVE-2023-42793
📋 TL;DR
CVE-2023-42793 is a critical authentication bypass vulnerability in JetBrains TeamCity CI/CD servers that allows unauthenticated attackers to execute arbitrary code remotely. This affects all organizations running vulnerable TeamCity Server instances, potentially compromising their entire build pipelines and deployment infrastructure.
💻 Affected Systems
- JetBrains TeamCity
📦 What is this software?
Teamcity by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the TeamCity server leading to full control over build pipelines, credential theft, lateral movement into connected systems, and deployment of malicious artifacts across the entire software supply chain.
Likely Case
Attackers gain administrative access to TeamCity, steal source code, modify build processes to inject malware, and potentially pivot to connected development and production environments.
If Mitigated
If isolated in a segmented network with strict access controls, impact may be limited to the TeamCity server itself, though build integrity would still be compromised.
🎯 Exploit Status
Multiple public exploit scripts are available. Attackers are actively scanning for and exploiting vulnerable instances. The vulnerability requires no authentication or special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.05.4 and later
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup your TeamCity configuration and data. 2. Download TeamCity 2023.05.4 or later from the JetBrains website. 3. Stop the TeamCity service. 4. Install the new version following JetBrains upgrade documentation. 5. Restart the TeamCity service. 6. Verify the version is updated.
🔧 Temporary Workarounds
Network Isolation
allImmediately restrict network access to TeamCity servers to only trusted IP addresses and required services.
Use firewall rules to block all external access except from authorized build agents and administrators
Reverse Proxy Authentication
allPlace TeamCity behind a reverse proxy that requires authentication before reaching the vulnerable endpoints.
Configure nginx/apache with authentication in front of TeamCity
🧯 If You Can't Patch
- Immediately take TeamCity servers offline until they can be patched
- Implement strict network segmentation and monitor all traffic to/from TeamCity servers for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check TeamCity version in Administration → Server Administration → Global Settings. If version is below 2023.05.4, you are vulnerable.Check Version:
Check TeamCity web interface at /admin/admin.html?item=diagnostics or examine teamcity-server.log for version informationVerify Fix Applied:
After patching, verify version shows 2023.05.4 or higher in the same location and test that authentication is required for all administrative endpoints.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to /app/rest/users administrative endpoints
- Unusual user creation or permission changes
- Suspicious build configuration modifications
Network Indicators:
- HTTP requests to /app/rest/users without authentication headers
- Unusual outbound connections from TeamCity server
- Traffic to known exploit tool IPs
SIEM Query:
source="teamcity.log" AND ("POST /app/rest/users" OR "PUT /app/rest/users" OR "GET /app/rest/users") AND NOT (user!="anonymous")🔗 References
- http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html
- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
- https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/
- https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/
- https://www.sonarsource.com/blog/teamcity-vulnerability/
- http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html
- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
- https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/
- https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42793
