TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)
JetBrains TeamCity On-Premises
An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.
Why this severity: CVSS 9.8 (NVD), actively exploited (CISA KEV), known ransomware use
- Started
- Sep 18, 2023
- Closed
- Dec 13, 2023
Affected
- Before 2023.05.4 (NVD)
Fixed in
- 2023.05.4
Updates by day4
▸Dec 13, 2023
Link #CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)
Source
▸Oct 18, 2023
Link #Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it
Source
▸Oct 4, 2023
Link #CISA adds CVE-2023-42793 to the KEV catalog
▸Sep 18, 2023
Link #JetBrains releases TeamCity 2023.05.4 and a security patch plugin
Source
Advisories4
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
