Critical Vulnerability in JetBrains TeamCity – CVE-2024-23917
JetBrains has identified a critical authentication bypass flaw, leading to possible RCE, in its TeamCity On-Premises software. TeamCity is a continuous integration and continuous deployment (CI/CD) software solution designed to automate and streamline the software development and delivery process, providing tools for building, testing, and deploying code efficiently. Marked as CVE-2024-23917, with a severity rating of 9.8 out of 10, this vulnerability could be exploited by threat actors to gain administrative control over susceptible instances.
Vulnerability Details:
- CVE Identifier: CVE-2024-23917
- Severity: Critical (CVSS 9.8)
- Description: The flaw allows an unauthenticated attacker with HTTP(S) access to bypass authentication checks and gain administrative control over the TeamCity server.
- Affected Versions: TeamCity On-Premises versions from 2017.1 through 2023.11.2.
Previous Exploitation Incidents:
- JetBrains highlighted that there is no evidence of exploitation in the wild. However, a similar flaw (CVE-2023-42793, CVSS score: 9.8) in the past was actively exploited by threat actors, including ransomware gangs and state-sponsored groups from North Korea and Russia.
Mitigation and Fixes:
- Official Fix: The vulnerability has been addressed in version 2023.11.3.
- Security Patch Plugin: Users unable to update immediately can apply fixes using a security patch plugin which is provided for users on versions 2017.1 through 2023.11.2.
- Publicly Accessible Servers: For publicly accessible servers, changing passwords and making the server temporarily inaccessible is recommended if immediate updates are not feasible.
Additional Information:
- User Verification: JetBrains assures that TeamCity Cloud servers have been patched, and there is no evidence of attacks on them.
- Threat Landscape: Shadowserver is monitoring over 2,000 exposed TeamCity servers, emphasizing the importance of prompt updates.
References
- https://blog.jetbrains.com/teamcity/2024/02/critical-security-issue-affecting-teamcity-on-premises-cve-2024-23917/
- https://thehackernews.com/2024/02/critical-jetbrains-teamcity-on-premises.html
- https://www.bleepingcomputer.com/news/security/jetbrains-warns-of-new-teamcity-auth-bypass-vulnerability/
- https://nvd.nist.gov/vuln/detail/CVE-2024-23917
- https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=jetbrains&model=teamcity&group_by=geo&style=stacked
