# TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793) · pwn.watch

> An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.

Page: https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793 · generated 2026-10-22T22:41:49.181Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: JetBrains TeamCity On-Premises
- Started: 2023-09-18 · closed: 2023-12-13
- CVEs: CVE-2023-42793
- Affected: Before 2023.05.4 (NVD)
- Fixed in: 2023.05.4

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793/feed.xml
- JSON Feed: https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json
- This file: https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793/llms.txt

## Updates (newest first)
- 2023-12-13: CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A) (https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a)
- 2023-10-18: Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it (https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/)
- 2023-10-04: CISA adds CVE-2023-42793 to the KEV catalog
- 2023-09-18: JetBrains releases TeamCity 2023.05.4 and a security patch plugin (https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/)

## Fix brief
# Security brief: TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)

Source: https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793 · status: closed (closed Dec 13, 2023) · severity: critical · updated Dec 13, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.

Severity detail: CVSS 9.8 (NVD), actively exploited (CISA KEV), known ransomware use

- Product: JetBrains TeamCity On-Premises
- CVE / advisory ids: CVE-2023-42793

## Affected versions
- Before 2023.05.4 (NVD)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 2023.05.4

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Dec 13, 2023: CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)
- Oct 18, 2023: Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it
- Oct 4, 2023: CISA adds CVE-2023-42793 to the KEV catalog
- Sep 18, 2023: JetBrains releases TeamCity 2023.05.4 and a security patch plugin

## Advisories
- [Critical Security Issue Affecting TeamCity On-Premises – Update to 2023.05.4 Now](https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/) (JetBrains)
- [Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally (AA23-347A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a) (CISA)
- [NVD: CVE-2023-42793](https://nvd.nist.gov/vuln/detail/CVE-2023-42793) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability](https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/)

---
Machine-readable: https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.