CVE-2023-42793: JetBrains TeamCity Auth Bypass Vulnerability

CVE-2023-42793 Overview

CVE-2023-42793 is a critical authentication bypass vulnerability in JetBrains TeamCity that allows unauthenticated attackers to achieve remote code execution (RCE) on vulnerable TeamCity Server instances. This vulnerability affects JetBrains TeamCity versions prior to 2023.05.4 and has been actively exploited in the wild, resulting in its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog.

TeamCity is a widely-used continuous integration and continuous deployment (CI/CD) platform employed by software development teams worldwide. The severity of this vulnerability is compounded by the critical role CI/CD servers play in the software supply chain—a compromised TeamCity server could enable attackers to inject malicious code into software builds, steal sensitive credentials and secrets, and pivot to other systems within an organization's infrastructure.

Critical Impact

Unauthenticated remote attackers can completely compromise TeamCity Server instances, enabling full system control, credential theft, and potential supply chain attacks through build pipeline manipulation.

Affected Products

• JetBrains TeamCity versions prior to 2023.05.4
• TeamCity on-premises installations (Cloud instances were patched by JetBrains)
• All operating systems running vulnerable TeamCity versions

Discovery Timeline

• 2023-09-19 - CVE-2023-42793 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2023-42793

Vulnerability Analysis

This authentication bypass vulnerability stems from improper access control mechanisms in the TeamCity web application. The flaw allows unauthenticated users to bypass authentication controls and access restricted functionality that should require administrator privileges. Once authenticated protections are bypassed, attackers can leverage built-in TeamCity functionality to execute arbitrary code on the underlying server.

The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function). These weakness classifications indicate that the application fails to properly validate user authentication state before providing access to sensitive administrative functions.

The exploitation chain typically involves accessing an unprotected API endpoint that allows for the creation of new administrative users or authentication tokens without requiring prior authentication. This design flaw enables attackers to bootstrap administrative access from an unauthenticated state.

Root Cause

The root cause of CVE-2023-42793 is missing authentication checks on critical API endpoints within the TeamCity web application. Specifically, certain endpoints that should enforce authentication validation fail to do so, creating an alternate path that bypasses normal authentication flows. This allows unauthenticated remote attackers to interact with administrative functionality intended only for authenticated privileged users.

The vulnerability exists because the application does not properly implement authentication requirements across all sensitive endpoints, leaving critical administrative functions exposed to unauthenticated access.

Attack Vector

The attack vector for CVE-2023-42793 is network-based and requires no user interaction or prior authentication. An attacker with network access to a vulnerable TeamCity server can exploit this vulnerability remotely through the following attack flow:

1. Initial Access: The attacker identifies an exposed TeamCity server through network scanning or internet-facing asset discovery
2. Authentication Bypass: The attacker sends specially crafted HTTP requests to unprotected API endpoints that bypass authentication checks
3. Privilege Acquisition: Through the vulnerable endpoints, the attacker creates a new administrator account or obtains an authentication token
4. Code Execution: With administrative access, the attacker leverages TeamCity's built-in functionality (such as build configurations or debug processes) to execute arbitrary commands on the server

The exploitation is straightforward and does not require complex attack chains or specialized tooling, making it accessible to a wide range of threat actors. Public exploit code is available through Packet Storm Security, significantly lowering the barrier to exploitation.

Detection Methods for CVE-2023-42793

Indicators of Compromise

• Unexpected new administrator accounts created in TeamCity
• Unusual authentication tokens generated outside of normal operational patterns
• Suspicious HTTP requests to TeamCity API endpoints from external or unknown IP addresses
• Modified build configurations or newly created build projects with malicious commands
• Unexpected process execution originating from the TeamCity server process

Detection Strategies

• Monitor TeamCity audit logs for unauthorized user account creation or token generation events
• Implement web application firewall (WAF) rules to detect and block known exploit patterns targeting TeamCity endpoints
• Deploy network intrusion detection systems (NIDS) with signatures for CVE-2023-42793 exploitation attempts
• Review TeamCity server access logs for requests from unexpected source IP addresses or anomalous request patterns

Monitoring Recommendations

• Enable verbose logging on TeamCity servers and forward logs to a centralized SIEM for correlation and analysis
• Establish baseline metrics for TeamCity administrative actions and alert on deviations
• Monitor for unexpected outbound network connections from TeamCity servers that may indicate post-exploitation activity
• Implement file integrity monitoring on TeamCity installation directories to detect unauthorized modifications

How to Mitigate CVE-2023-42793

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2023.05.4 or later immediately
• If immediate patching is not possible, restrict network access to TeamCity servers using firewall rules
• Audit existing TeamCity user accounts and authentication tokens for any unauthorized entries
• Review build configurations for any suspicious or unexpected modifications
• Isolate potentially compromised TeamCity servers from production networks pending investigation

Patch Information

JetBrains has released version 2023.05.4 which addresses this vulnerability. Organizations should upgrade to this version or later as the primary remediation measure. For detailed patch information and security updates, refer to the JetBrains Security Patch Notes and the JetBrains Vulnerability Post-Mortem.

TeamCity Cloud instances were automatically patched by JetBrains. Organizations using on-premises installations must apply the update manually.

Workarounds

• Implement network segmentation to ensure TeamCity servers are not directly accessible from the internet
• Configure reverse proxy or load balancer rules to block access to vulnerable API endpoints
• Enable IP whitelisting to restrict access to TeamCity servers to known authorized networks only
• Consider temporarily disabling TeamCity services if immediate patching is not feasible and the server is internet-exposed

# Example firewall rule to restrict TeamCity access to internal networks only
# For iptables-based systems
iptables -A INPUT -p tcp --dport 8111 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8111 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8111 -j DROP