What is TeamCity? #
TeamCity is a JetBrains product that allows customers to combine the practices of Continuous Integration with Continuous Delivery, or CICD to build and deliver their software. This makes the patching of this vulnerability of higher importance since it would allow an attacker a potential foothold into the supply chain of products built using the TeamCity On-Premises product. Although JetBrains provides a cloud-hosted instance of TeamCity, only customer-hosted instances, which include the Professional and Enterprise editions are currently affected by the vulnerability.
Latest TeamCity vulnerabilities #
On March 3rd, 2024, JetBrains disclosed two serious vulnerabilities in the TeamCity On-Premises product.
The first issue, CVE-2024-27198, allows attackers to bypass authentication controls and access the TeamCity installation with administrative privileges. This issue has been given a CVSS score of 9.8, indicating a highly critical vulnerability.
The second issue, CVE-2024-27199, is a path-traversal vulnerability allowing attackers to perform limited administative actions without proper authentication. This issue has been given a CVSS score of 7.3, indicating a high severity.
What is the impact? #
Upon successful exploitation of these vulnerabilities, attackers can execute arbitrary commands on the vulnerable system. This includes the creation of new users, installation of additional modules or code, and, in general, system compromise.
Are updates/workarounds available? #
JetBrains has released an update to mitigate this issue. Users are urged to update as quickly as possible.
How to find TeamCity installations with runZero #
TeamCity On-Premises assets can be found by navigating to the Asset Inventory and using the following pre-built query to locate TeamCity services on your network:
product:"TeamCity"
Results from the above query should be triaged to determine if they require patching or vendor intervention. Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.
CVE-2024-23917 (February 2024) #
On February 6th, 2024, JetBrains disclosed a serious vulnerability, CVE-2024-23917, allowing attackers who can access the TeamCity installation via HTTPS to bypass authentication mechanisms and gain administrative privileges on the affected systems.
JetBrains released an update to mitigate this issue. Users were urged to update as quickly as possible.
CVE-2023-42793 (September 2023) #
On September 20th, 2023, JetBrains announced a critical authentication bypass vulnerability that impacted users running the TeamCity On-Premises product. The vulnerability was tracked using CVE-2023-42793, and presented the weakness of CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Successfully exploiting this vulnerability would allow an unauthenticated remote attacker to perform a Remote Code Execution (RCE) attack and gain administrative access to the underlying system.
JetBrains issued a patch for this vulnerability in revision 2023.05.4, encouraging all users to upgrade. For users that could not immediately apply the update, a security patch plugin was also made available. More information can be found on JetBrain’s website.
