Patch Now: Critical TeamCity Bug Allows for Server Takeovers

Cyberattackers can exploit a vulnerability in JetBrains continuous integration and delivery (CI/CD) server (a popular APT target) to gain administrative control.

JetBrains has patched a critical security vulnerability in its TeamCity On-Premises server that can allow unauthenticated remote attackers to gain control over an affected server and use it to perform further malicious activity within an organizations environment.
TeamCity is a software development lifecycle (SDLC) management platform that about 30,000 organizations — including several major brands like Citibank, Nike, and Ferrari — use to automate processes to build, test, and deploy software. As such, its home to scores of data that can be useful to attackers, including source code and signing certificates, and also could allow for tampering with compiled versions software or deployment processes.
The flaw, tracked as
CVE-2024-23917
, presents the weakness
CWE-288
, which is an authentication bypass using an alternate path or channel. JetBrains identified the flaw on Jan. 19; it affects all versions from 2017.1 through 2023.11.2 of its TeamCity On-Premises continuous integration and delivery (CI/CD) server.
If abused, the flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server, TeamCitys Daniel Gallo wrote
in a blog post detailing CVE-2024-23917,
published earlier this week.
JetBrains already has released an update that addresses the vulnerability, TeamCity On-Premises
version 2023.11.3
, and also patched its own TeamCity Cloud servers. The company also verified that its own servers were not attacked.
Indeed, TeamCity On-Premises flaws are not to be taken lightly, as the last major flaw discovered in the product spurred a global security nightmare when various state-sponsored actors targeted it to engage in a range of malicious behavior.
In that case, a public proof-of-concept (PoC) exploit for a critical remote code execution (RCE) bug tracked as
CVE-2023-42793
— found by JetBrains and patched last Sept. 30 — triggered near immediate exploitation by two North Korean state-backed threat groups tracked by Microsoft as Diamond Sleet and Onyx Sleet. The groups
exploited the flaw
to drop backdoors and other implants for carrying out a wide range of malicious activities, including cyber espionage, data theft, and financially motivated attacks.
Then in December, APT29 (aka CozyBear, the Dukes,
Midnight Blizzard
, or Nobelium), the notorious
Russian threat group
behind the 2020 SolarWinds hack, also
pounced on the flaw
. In activity tracked by CISA, the FBI, and the NSA, among others, the APT hammered vulnerable servers, using them for initial access to escalate privileges, move laterally, deploy additional backdoors, and take other steps to ensure persistent and long-term access to the compromised network environments.
Hoping to avoid a similar scenario with its latest flaw, JetBrains urged anyone with affected products in their environment to immediately update to the patched version.
If this isnt possible, JetBrains also released a security patch plugin thats available for download and can be installed on TeamCity versions 2017.1 through 2023.11.2 that will fix the issue. The company also
posted installation instructions
online for the plugin to help customers mitigate the issue.
TeamCity stressed however that the security patch plugin will only address the vulnerability and not provide other fixes, so customers are highly recommended to install the latest version of TeamCity On-Premises to benefit from many other security updates, Gallo wrote.
Further, if an organization has an affected server that is publicly accessible over the Internet and cant take either of those mitigation steps, JetBrains recommended that the server is made in accessible until the flaw can be mitigated.
Considering the history of exploitation when it comes to TeamCity bugs, patching is a necessary and crucial first step that organizations need to take to handle the issue, Brian Contos, CSO at Sevco Security, observes. However, given that there could be Internet-facing servers that a company has lost track of, he suggests further steps may need to be taken to more firmly lock down an IT environment.
Its hard enough to defend the attack surface you know about, but it becomes impossible when there are vulnerable servers that dont show up on your IT asset inventory, Contos says. Once the patching is taken care of, security teams must turn their attention to a longer-term, more sustainable approach to vulnerability management.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Patch Now: Critical TeamCity Bug Allows for Server Takeovers