CVE-2023-42793
JetBrains TeamCity Authentication Bypass Vulnerability
Description
CVE-2023-42793 is a critical authentication bypass vulnerability in JetBrains TeamCity that allows an unauthenticated remote attacker to achieve remote code execution (RCE) on the TeamCity Server. The vulnerability affects JetBrains TeamCity versions before 2023.05.4 and exploits weaknesses in authentication using an alternate path (CWE-288) combined with missing authentication for a critical function (CWE-306). With a CVSS v3.1 score of 9.8 (Critical), CVE-2023-42793 requires no authentication, no user interaction, and is trivially exploitable over the network. CISA has added this TeamCity vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 25, 2023, and ransomware operators are confirmed to be exploiting it. The EPSS score of 92.9% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jetbrains | teamcity | < 2023.05.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/174860/JetBrains-TeamCity-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793(Third Party Advisory)
- https://blog.jetbrains.com/teamcity/2023/09/cve-2023-42793-vulnerability-post-mortem/(Vendor Advisory)
- https://www.jetbrains.com/privacy-security/issues-fixed/(Vendor Advisory)
- https://www.rapid7.com/blog/post/2023/09/25/etr-cve-2023-42793-critical-authentication-bypass-in-jetbrains-teamcity-ci-cd-servers/(Broken Link, Third Party Advisory)
- https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/(Press/Media Coverage)
- https://www.sonarsource.com/blog/teamcity-vulnerability/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42793(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-288 describes a weakness where the software provides an alternate path or channel for authentication that does not require the same level of security as the primary mechanism. In CVE-2023-42793, JetBrains TeamCity exposes an alternate authentication path that allows attackers to bypass the normal login process entirely and gain access to critical server functions without any credentials.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
CWE-306: Missing Authentication for Critical Function
CWE-306 describes a weakness where the software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. In CVE-2023-42793, certain critical TeamCity Server functions lack proper authentication checks, allowing unauthenticated attackers to execute administrative actions including code execution on the server.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2023-42793 carries a CVSS v3.1 score of 9.8 (Critical severity) and represents an extremely dangerous threat to organizations using JetBrains TeamCity for continuous integration and delivery. Attack Vector (Network): The vulnerability is remotely exploitable without physical access, making any internet-facing or network-accessible TeamCity Server an immediate target. Attack Complexity (Low): No special conditions, timing, or preparation are required to exploit this flaw. Privileges Required (None): The attack bypasses authentication entirely, requiring no credentials or existing user account. User Interaction (None): No action from any user is required to trigger the exploit. Confidentiality Impact (High): An attacker can access source code repositories, build configurations, deployment credentials, secrets, and API keys stored in TeamCity. Integrity Impact (High): With code execution on the build server, an attacker can inject malicious code into build pipelines, tamper with software artifacts, and conduct supply chain attacks. Availability Impact (High): The attacker can disrupt the entire CI/CD pipeline, halting software development and deployment operations. The EPSS score of 92.9% confirms near-certain exploitation, and CISA has confirmed that ransomware operators are actively leveraging this vulnerability.
Exploit Maturity
Public exploit code is available for CVE-2023-42793 via Packet Storm Security and SonarSource’s detailed technical analysis, both providing proof-of-concept exploits for unauthenticated remote code execution. CISA has confirmed active exploitation in the wild and added CVE-2023-42793 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 25, 2023. Ransomware usage is confirmed — threat actors have incorporated this TeamCity authentication bypass into ransomware attack chains, leveraging access to CI/CD infrastructure for lateral movement and supply chain compromise. The EPSS score of 92.9% (99.76th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted vulnerabilities in the CI/CD tool landscape.
Remediation
- Upgrade JetBrains TeamCity to version 2023.05.4 or later immediately. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. JetBrains released a patch in TeamCity 2023.05.4 that addresses this authentication bypass vulnerability.
- Audit TeamCity Server for indicators of compromise. Review TeamCity audit logs for unauthorized access, new user account creation, or unexpected build configuration changes. Check for unauthorized API token generation, modified build steps, or suspicious plugin installations. Investigate any unknown processes running on the TeamCity Server host.
- Restrict network access to TeamCity Server. Ensure the TeamCity Server is not directly accessible from the public internet. Place it behind a VPN or reverse proxy with authentication, and restrict access to authorized development team IP ranges using firewall rules.
- Rotate all credentials and secrets stored in TeamCity. After patching, rotate all build agent authentication tokens, VCS credentials, deployment keys, API tokens, and any other secrets stored in TeamCity build configurations or project parameters, as these may have been compromised.
- Implement authentication hardening for CI/CD infrastructure. Enforce multi-factor authentication for all TeamCity user accounts, implement the principle of least privilege for build configurations, conduct regular security assessments of CI/CD pipelines, and ensure all critical functions require proper authentication as a defense against CWE-288 and CWE-306 class vulnerabilities.
Technical Details
CVE-2023-42793 exploits authentication bypass weaknesses in JetBrains TeamCity Server versions before 2023.05.4. Attack Vector (Network): The attack is conducted remotely by sending crafted HTTP requests to the TeamCity Server web interface. Attack Complexity (Low): The exploit requires no special conditions — an attacker simply accesses specific endpoints that lack proper authentication enforcement. The vulnerability combines two weakness types: CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function). The TeamCity Server exposes certain administrative API endpoints or paths that do not enforce the same authentication requirements as the primary login mechanism, allowing an unauthenticated attacker to create authentication tokens or directly invoke privileged operations. By bypassing authentication through these alternate paths, an attacker can generate administrative access tokens and subsequently execute arbitrary code on the TeamCity Server, achieving full remote code execution. The critical nature of this vulnerability is compounded by TeamCity’s role as a CI/CD server, where compromise can lead to supply chain attacks through manipulation of build pipelines and deployment processes.
Frequently Asked Questions
Is CVE-2023-42793 being actively exploited?
Yes, CVE-2023-42793 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 25, 2023. Ransomware operators have been confirmed to incorporate this vulnerability into their attack chains, and multiple public exploit tools are available. The EPSS score of 92.9% indicates near-certain exploitation activity.
What products are affected by CVE-2023-42793?
CVE-2023-42793 affects JetBrains TeamCity Server versions prior to 2023.05.4. Both on-premises and self-hosted TeamCity installations are vulnerable. Organizations should check their TeamCity version and upgrade immediately if running an affected version.
How do I fix CVE-2023-42793?
Upgrade JetBrains TeamCity Server to version 2023.05.4 or later immediately. After patching, audit your TeamCity instance for unauthorized access, rotate all stored credentials and secrets, and restrict network access to the server. See the Remediation section above for detailed steps.
How severe is CVE-2023-42793?
CVE-2023-42793 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It allows unauthenticated remote code execution on TeamCity Servers with no user interaction required. The EPSS score of 92.9% (99.76th percentile) indicates near-certain exploitation, and the vulnerability has been linked to ransomware campaigns. The risk is amplified by TeamCity’s role as a CI/CD server, where compromise can enable supply chain attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.