pwn.watch: CI/CD incident updates

[critical] Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE

Mon, 19 Aug 2024 00:00:00 GMT

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: Jenkins 2.442, LTS 2.426.3, LTS 2.440.1

Latest updates:

2024-08-19: CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09) (source)
2024-01-24: CVE-2024-23897 published (source)
2024-01-24: Jenkins security advisory and fixed releases (source)

CVEs: CVE-2024-23897

[critical] JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited

Thu, 07 Mar 2024 00:00:00 GMT

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: 2023.11.4 (JetBrains)

Latest updates:

2024-03-07: CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28) (source)
2024-03-04: CVE-2024-27198 published (source)
2024-03-04: CVE-2024-27199 published (source)

CVEs: CVE-2024-27198, CVE-2024-27199

[critical] TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)

Wed, 13 Dec 2023 00:00:00 GMT

An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.

Status: closed · Patch: patched · Fixed in: 2023.05.4

Latest updates:

2023-12-13: CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A) (source)
2023-10-18: Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it (source)
2023-10-04: CISA adds CVE-2023-42793 to the KEV catalog

CVEs: CVE-2023-42793

[critical] CircleCI breach: rotate every secret

Fri, 13 Jan 2023 00:00:00 GMT

Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-01-13: Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated (source)
2023-01-04: CircleCI tells all customers to rotate every secret stored in CircleCI (source)