Critical Vulnerability in JetBrains TeamCity

Critical Vulnerability in JetBrains TeamCity – CVE-2024-23917

JetBrains has identified a critical authentication bypass flaw, leading to possible RCE, in its TeamCity On-Premises software. TeamCity is a continuous integration and continuous deployment (CI/CD) software solution designed to automate and streamline the software development and delivery process, providing tools for building, testing, and deploying code efficiently. Marked as CVE-2024-23917, with a severity rating of 9.8 out of 10, this vulnerability could be exploited by threat actors to gain administrative control over susceptible instances.

Vulnerability Details:

CVE Identifier: CVE-2024-23917
Severity: Critical (CVSS 9.8)
Description: The flaw allows an unauthenticated attacker with HTTP(S) access to bypass authentication checks and gain administrative control over the TeamCity server.
Affected Versions: TeamCity On-Premises versions from 2017.1 through 2023.11.2.

Previous Exploitation Incidents:

JetBrains highlighted that there is no evidence of exploitation in the wild. However, a similar flaw (CVE-2023-42793, CVSS score: 9.8) in the past was actively exploited by threat actors, including ransomware gangs and state-sponsored groups from North Korea and Russia.

Mitigation and Fixes:

Official Fix: The vulnerability has been addressed in version 2023.11.3.

Security Patch Plugin: Users unable to update immediately can apply fixes using a security patch plugin which is provided for users on versions 2017.1 through 2023.11.2.

Publicly Accessible Servers: For publicly accessible servers, changing passwords and making the server temporarily inaccessible is recommended if immediate updates are not feasible.

Additional Information:

User Verification: JetBrains assures that TeamCity Cloud servers have been patched, and there is no evidence of attacks on them.
Threat Landscape: Shadowserver is monitoring over 2,000 exposed TeamCity servers, emphasizing the importance of prompt updates.