JetBrains TeamCity CVE-2023-42793 RCE Attempt

The CVE-2023-42793 vulnerability in JetBrains TeamCity On-Premises allows an unauthenticated attacker to perform remote code execution. This vulnerability affects versions prior to 2023.05.4. The vulnerability arises from improper handling of authentication tokens, specifically related to the /app/rest/users/id:1/tokens/RPC2 endpoint. An attacker can exploit this by sending a specially crafted POST request. Successful exploitation grants the attacker administrative privileges, potentially leading to full system compromise, data breaches, and further unauthorized access within the network. Detection efforts should focus on monitoring web traffic for suspicious POST requests targeting the identified endpoint.

Attack Chain

1. The attacker identifies a vulnerable JetBrains TeamCity On-Premises instance running a version prior to 2023.05.4.
2. The attacker crafts a malicious POST request targeting the /app/rest/users/id:1/tokens/RPC2 endpoint.
3. The attacker sends the crafted POST request to the vulnerable TeamCity server.
4. The TeamCity server improperly processes the request due to the CVE-2023-42793 vulnerability.
5. The attacker gains unauthorized administrative access to the TeamCity server.
6. The attacker leverages the gained administrative access to execute arbitrary code on the server.
7. The attacker establishes persistence on the compromised TeamCity server.
8. The attacker uses the compromised TeamCity server as a pivot point to move laterally within the network and compromise other systems or exfiltrate sensitive data.

Impact

Successful exploitation of CVE-2023-42793 can lead to a complete compromise of the JetBrains TeamCity server. This includes unauthorized access to sensitive project data, build configurations, and potentially source code. Furthermore, attackers can leverage the compromised TeamCity server as a stepping stone to infiltrate other systems within the organization's network, leading to widespread data breaches, ransomware deployment, or intellectual property theft. This vulnerability impacts organizations that rely on JetBrains TeamCity for their CI/CD pipeline.

Recommendation

• Deploy the Sigma rule Detect TeamCity CVE-2023-42793 Attempt to your SIEM to detect exploitation attempts based on HTTP requests.
• Inspect web server logs for POST requests to /app/rest/users/id:1/tokens/RPC2 with a 200 status code, as highlighted in the main search query.
• Apply filters to the Sigma rule Detect TeamCity CVE-2023-42793 Attempt to reduce false positives, focusing on uncommon user agents as described in the "known_false_positives" section.
• Immediately patch all JetBrains TeamCity On-Premises instances to version 2023.05.4 or later to remediate the CVE-2023-42793 vulnerability, as advised by JetBrains.