RCE in JetBrains TeamCity (CVE-2023-42793)

TeamCity On-Premises before 2023.05.4 carries an authentication bypass in its REST API that an unauthenticated attacker can chain up to remote code execution as the CI server user.

The chain has two parts:

• Authentication bypass. By manipulating the API path (for instance forcing a 404 on a preceding resource and slipping in /app/rest/...), you reach endpoints that should require a session. With it you create an access token for an administrative account:

curl -X POST "http://<ip>/app/rest/users/id:1/tokens/RPC2" -H "Content-Type: application/json"

• RCE. With that token, the API lets you modify internal server parameters (such as the build-tool paths) and deploy a plugin or script that TeamCity runs. Public PoCs automate both steps and return a shell.

On a CI this is especially serious: the server usually holds deployment credentials, SSH keys and repository tokens (secrets in source), and its build history may contain recoverable private keys (.git dump).

Nuances. It affects TeamCity On-Premises; TeamCity Cloud was patched by the vendor. The exact bypass path depends on the version, so confirm the version (/login.html shows it) before firing a specific PoC.

How to detect it. The bypass leaves a recognizable signature in the access log: requests that force a 404 on a prior resource and then an unauthenticated POST to /app/rest/users/id:1/tokens/..., i.e. the creation of a token for an administrative account through a path that skips the session. On the host, the RCE phase shows as the TeamCity process (java) spawning an anomalous child after internal server parameters are modified or a plugin/script is deployed. The creation of an administrative token from an external IP, or a change to the build-tools path followed by execution, is the chain.

Defence. Upgrade to 2023.05.4 or later; restrict network access to the CI panel; rotate stored tokens and credentials after any suspicion, since their value persists beyond the patch.