JetBrains TeamCity Authentication Bypass Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-10-04
• Known to be used in ransomware campaigns
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

CISA: JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Exe…ExploitThird Party AdvisoryVDB Entry
• attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793Third Party Advisory
• blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortemVendor Advisory
• www.jetbrains.com/privacy-security/issues-fixedVendor Advisory
• www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-i…Broken LinkThird Party Advisory
• www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-serversPress/Media Coverage
• www.sonarsource.com/blog/teamcity-vulnerabilityExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource