CVE-2023-42793 Vulnerability in TeamCity: Post-Mortem

Olga Bedrina

Summary

• A critical vulnerability issue for TeamCity On-Premises was discovered by the Sonar team. TeamCity Cloud was not affected.
• The TeamCity team released the 2023.05.4 fix for the issue.
• We created a plugin that works for older TeamCity versions (8.0+) and recommended installing it to all customers who could not upgrade quickly enough.
• We notified all TeamCity On-Premises customers about the vulnerability.
• The issue was publicly announced.

Actions taken by the TeamCity team

On September 6, 2023, we received a report from Sonar regarding a critical vulnerability issue identified in TeamCity On-Premises. If abused, the flaw could enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to perform a remote code execution (RCE) attack and gain administrative control of the TeamCity server. 

We confirmed receiving the report on the same day and proceeded with the internal investigation. On September 14, 2023, we reported back to Sonar. We confirmed it to be a major security issue and stated that we had reproduced the issue and prepared a fix for it. Please refer to the Sonar blog post for technical details about how the issue can be reproduced.

We then proceeded with handling the issue. On September 18, 2023, we released version 2023.05.4 that contained a fix for the issue. We also created a plugin for older TeamCity versions (8.0+). Thanks to the plugin, any customers who were unable to update to the latest TeamCity version could still apply the fix.

The plugin can be downloaded here:

• Versions prior to 2018.1 –- https://download.jetbrains.com/teamcity/plugins/internal/CVE-2023-42793-fix-2018-1.zip. 
• Versions 2018.2+ – https://download.jetbrains.com/teamcity/plugins/internal/CVE-2023-42793-fix-recent-versions.zip. 

We then notified TeamCity Enterprise customers about the issue, encouraging them to update their servers to the latest version, 2023.05.4, which can be found here: https://www.jetbrains.com/teamcity/download/other.html. 

After that, the issue was publicly announced on September 21, 2023. Both the Sonar and TeamCity teams published blog posts about the discovered vulnerabilities.

We’d like to thank the Sonar team for discovering the issue and their collaboration on the public announcement.

Timeline

Subscribe to TeamCity Blog updates

Subscribe form

By submitting this form, I agree to the JetBrains Privacy Policy Notification icon

By submitting this form, I agree that JetBrains s.r.o. ("JetBrains") may use my name, email address, and location data to send me newsletters, including commercial communications, and to process my personal data for this purpose. I agree that JetBrains may process said data using third-party services for this purpose in accordance with the JetBrains Privacy Policy. I understand that I can revoke this consent at any time in my profile. In addition, an unsubscribe link is included in each email.

Submit

Thanks, we've got you!