CISA Warns of Critical TeamCity RCE Vulnerability, CVE-2023-42793, Actively Exploited

Key Takeaways

• A critical unauthenticated remote code execution (RCE) vulnerability, CVE-2023-42793, in JetBrains TeamCity On-Premises is under active exploitation.
• This flaw allows attackers to bypass authentication and execute arbitrary code with server privileges.
• All TeamCity On-Premises versions prior to 2023.11.7 and 2023.12.3 are affected.
• Patches are available, and immediate remediation is strongly advised to prevent severe supply chain risks.

Critical TeamCity RCE Vulnerability Under Active Exploitation

The United States Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability within JetBrains TeamCity On-Premises, identified as CVE-2023-42793. This flaw is actively being exploited in the wild, posing a significant threat to organizations utilizing the continuous integration and continuous delivery (CI/CD) platform.

The vulnerability enables an unauthenticated attacker to achieve remote code execution (RCE) on affected TeamCity On-Premises servers. CISA promptly added this issue to its Known Exploited Vulnerabilities catalog on August 5, mandating that federal civilian executive branch agencies remediate the flaw by August 8.

Understanding the Risk

TeamCity serves as a vital CI/CD platform, orchestrating the build, test, and deployment phases of software development. A successful compromise of its central server can trigger profound supply-chain risks. Attackers could potentially gain unauthorized access to sensitive assets such as source code repositories, build configurations, stored secrets, signing materials, and deployment connections. Furthermore, they could manipulate build outputs or leverage the compromised server as a strategic pivot point for broader network infiltration.

The vulnerability is categorized under CWE-502, “Deserialization of Untrusted Data,” and specifically impacts the TeamCity agent polling protocol, which manages communication between build agents and the TeamCity server.

Technical Details of the Exploit

The flaw permits a remote attacker with HTTP or HTTPS access to bypass authentication mechanisms entirely. This allows them to execute arbitrary operating system commands with the same privileges as the TeamCity server process, requiring no valid user account or prior authentication. JetBrains confirmed that all TeamCity On-Premises versions released before the security updates were susceptible to this critical vulnerability.

Remediation and Mitigation

JetBrains has released patched versions 2023.11.7 and 2023.12.3 to address CVE-2023-42793. Organizations unable to perform an immediate full upgrade have the option to deploy JetBrains’ security patch plugin, which supports TeamCity versions 2017.1 and later. However, it is crucial to note that this plugin only mitigates this specific vulnerability; a complete update to a patched version remains the recommended long-term solution for comprehensive security.

TeamCity Cloud customers are not required to take any action, as JetBrains has already implemented the necessary protections on their cloud infrastructure. CISA’s inclusion of this vulnerability in its catalog underscores the confirmed active exploitation and elevates the urgency for immediate action.

While CISA has not publicly confirmed the use of ransomware in relation to this specific vulnerability, the agency’s catalog entry lists its status as unknown. Nevertheless, CI/CD systems, when exposed, represent high-value targets for threat actors seeking initial access, credential theft, and lateral movement within enterprise networks.

What You Should Do

• Identify All Installations: Locate every TeamCity On-Premises installation within your environment, including development, testing, and disaster recovery systems.
• Apply Patches Immediately: Prioritize updating to a fixed release (versions 2023.11.7 or 2023.12.3) or deploy the vendor-provided security patch plugin if an immediate upgrade is not feasible.
• Restrict Access: Limit TeamCity server access to only trusted users, build agents, and networks. Eliminate any unnecessary public exposure.
• Monitor Logs: Review server and web logs for any unusual agent polling activity, unexpected administrator actions, unfamiliar plugins, newly created accounts, or suspicious command executions.
• Preserve Evidence: If a compromise is suspected, preserve all relevant logs and system evidence before implementing major changes.
• Rotate Credentials: Rotate all credentials, tokens, certificates, and other secrets stored within or accessible via the TeamCity platform.
• Inspect Builds: Scrutinize recent builds and release artifacts for any unauthorized modifications.
• Assess Exposure: Evaluate each asset’s internet exposure and adhere to CISA’s risk-based patching and forensic triage guidelines.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.