TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)

Updates on Oct 4, 2023

Summary

An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.

Advisories4

• Critical Security Issue Affecting TeamCity On-Premises – Update to 2023.05.4 NowJetBrains
• Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally (AA23-347A)CISA · Dec 13, 2023
• NVD: CVE-2023-42793NVD
• CISA Known Exploited Vulnerabilities CatalogCISA · Oct 4, 2023