Experts warn of a critical vulnerability in the TeamCity CI/CD server that can be exploited to take over a vulnerable server.
JetBrains TeamCity is a popular and highly extensible Continuous Integration (CI) and Continuous Delivery (CD) server developed by JetBrains, a software development company known for its developer tools. TeamCity is designed to automate various aspects of the software development process, including building, testing, and deploying applications, while providing a wide range of features and integrations to support collaborative development.
Sonar’s Vulnerability Research Team discovered a critical security vulnerability, tracked as CVE-2023-42793 (CVSS score of 9.8), in TeamCity.
The vulnerability is an authentication bypass issue affecting the on-premises version of TeamCity. An attacker can exploit the flaw to steal source code and stored service secrets and private keys of the target organization. By injecting malicious code, an attacker can also compromise the integrity of software releases and impact all downstream users.
“TeamCity server version 2023.05.3 and below is prone to an authentication bypass, which allows an unauthenticated attacker to gain remote code execution (RCE) on the server. This enables attackers not only to steal source code but also stored service secrets and private keys. And it’s even worse: With access to the build process, attackers can inject malicious code, compromising the integrity of software releases and impacting all downstream users.” reads the post published by Sonar. “The attack does not require any user interaction.”
According to Shodan, more than 3,000 on-premises servers are exposed to the Internet.
The flaw impacts on-premises version 2023.05.3 and below, and JetBrains addressed the flaw with the release of version 2023.05.4. The issue does not affect TeamCity Cloud.
“The security patch plugin will only address the RCE vulnerability described above. We always recommend users upgrade their servers to the latest version to benefit from many other security updates,” reads the advisory published by JetBrains explains. “If you are unable to update your server to version 2023.05.4, we have also released a security patch plugin so that you can still patch your environment. The security patch plugin can be downloaded using one of the links below and installed on TeamCity 8.0+. It will patch the specific RCE vulnerability described above. For TeamCity 2019.2 and later, the plugin can be enabled without restarting the TeamCity server. For versions older than 2019.2, a server restart is required after the plugin has been installed.”
The link for the Security patch plugin are for TeamCity 2018.2 to 2023.05.3 | for TeamCity 8.0 to 2018.1
Sonar did not publish details of this vulnerability because it is easily exploitable.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, RCE)
